Week of August 4, 2025

Sophos X-Ops uncovered HeartCrypt, a packer-as-a-service derived from EDRKillShifter, being used by at least eight ransomware groups to disable EDR and AV products before deploying ransomware. The tool injects malicious code into signed executables and uses BYOVD to load a kernel driver that terminates security processes. This represents a significant escalation in ransomware tactics through cybercrime-as-a-service.

In a recent incident response case in Brazil, attackers used a Bring Your Own Vulnerable Driver (BYOVD) technique with the legitimate ThrottleStop.sys driver to terminate antivirus processes. The attack began with valid RDP credentials, followed by credential theft and lateral movement, ultimately deploying MedusaLocker ransomware. The AV killer has been observed in the wild since at least October 2024.

A research paper tested four advanced evasion techniques against Microsoft Defender for Endpoint and its cloud-based AI/ML protection. The techniques included Early Cryo Bird injection, direct syscalls with encrypted shellcode, ZigStrike injection, and a covert C2 channel via browser native messaging. Results showed that while some techniques bypassed EDR, cloud AI detection caught most, except for the ZigStrike XLL and native messaging C2 methods.

CVE-2025-54987 is a critical pre-authentication remote code execution vulnerability in the Trend Micro Apex One on-premises management console. It allows unauthenticated attackers to upload malicious code and execute arbitrary OS commands via OS command injection. The flaw is similar to CVE-2025-54948 but affects a different CPU architecture.

Huntress released a Tamper Protection feature for its endpoint agent to prevent unauthorized users and threat actors from stopping, uninstalling, or manipulating the agent. The feature uses a kernel-mode driver on Windows and a system extension on macOS to protect agent services, files, and registry keys. It is managed via the Huntress portal and can be temporarily disabled for maintenance.