Kaspersky

Attackers compromised the official JDownloader website and replaced download links with trojanized installers. The malicious installer deploys a Python bot, an r77 rootkit, and a WDAC policy that blocks 50 security executables from running, effectively killing antivirus protection. The attack uses dead-drop resolvers for resilient C2 communication.

A malvertising campaign since January 2026 uses fraudulent Google ads to deliver a kernel-mode EDR terminator named HwAudKiller. It exploits a previously undocumented vulnerability in the signed Huawei driver HWAuidoOs2Ec.sys to terminate 23 security products from ring-0, bypassing user-mode protections. The campaign has compromised over 60 victims, enabling credential theft and lateral movement.

Sophos X-Ops uncovered HeartCrypt, a packer-as-a-service derived from EDRKillShifter, being used by at least eight ransomware groups to disable EDR and AV products before deploying ransomware. The tool injects malicious code into signed executables and uses BYOVD to load a kernel driver that terminates security processes. This represents a significant escalation in ransomware tactics through cybercrime-as-a-service.

A new open-source tool named Nyx-BlindEdr has been published on GitHub, designed to blind Endpoint Detection and Response (EDR) systems by clearing kernel callbacks. The project is intended for educational purposes and demonstrates a technique to disable security product functionality on Windows.

SentinelOne reports that the Fin7 threat group has developed and sold a custom tool called AvNeutralizer (aka AuKill) that tampers with endpoint detection and response (EDR) solutions. The tool has been used by multiple ransomware gangs, including AvosLocker, MedusaLocker, BlackCat, and LockBit, since early 2023. AvNeutralizer leverages a previously unseen technique using the Windows TTD monitor driver ProcLaunchMon.sys and a hardened process explorer driver to cause a denial-of-service condition on affected security products.

SafeBreach researchers disclosed vulnerabilities in Microsoft Defender and Kaspersky EDR that allow attackers to remotely delete legitimate files by inserting malware byte signatures into them, causing false-positive detections. Microsoft issued patches (CVE-2023-24860, CVE-2023-3601) but initial fixes were bypassed, while Kaspersky acknowledged the issue as a design limitation. The flaws highlight risks in signature-based detection and the difficulty of fully mitigating such design-level weaknesses.

Between August 2022 and May 2023, an updated MATA backdoor framework targeted defense and oil/gas firms in Eastern Europe via spear-phishing. Attackers gained access to endpoint security admin panels and used them to surveil infrastructure and distribute malware. They bypassed EDR using a public exploit for CVE-2021-40449 (CallbackHell) and BYOVD techniques.

A denial-of-service vulnerability in multiple Windows EDR products allows a low-privileged user to permanently disable the agent after a reboot by preemptively registering an ALPC port name used by the EDR. The affected EDRs fail to handle the case where the port is already in use, causing user-mode components to crash or become non-functional. Kernel components remain running but lose detection/blocking capabilities in most cases.

SafeBreach Labs researchers discovered vulnerabilities in several EDR products that allow remote deletion of critical files and databases without authentication. By inserting minimal malicious signatures into files like web server logs, attackers can trick EDRs into automatically deleting the file, leading to data loss and denial of service. The research was presented at Black Hat USA 2023.

A video and Reddit post surfaced on May 28, 2023, showing an executable that allegedly disables tamper protection and terminates the on-premise agents of numerous endpoint security products. The tool claims to work against vendors including CrowdStrike, SentinelOne, Carbon Black, and Windows Defender. ThreatLocker notes that its application allowlisting would block such an unknown executable from running.