Sophos

Broadcom researchers disclosed Reynolds ransomware in February 2026, which embeds the vulnerable NsecSoft NSecKrnl driver (CVE-2025-68947) directly into its payload to terminate endpoint security processes before encrypting files. This single-binary approach eliminates the detection gap of traditional BYOVD attacks, making it harder for defenders to spot. The ransomware targets major EDR products including CrowdStrike Falcon, Cortex XDR, and others.

A proof-of-concept demonstrates an in-memory PE loader that downloads and executes a portable executable (e.g., putty.exe, EDRSilencer, Mimikatz) within an already-approved process, avoiding disk writes and evading detection by EDR solutions like Microsoft Defender XDR and Sophos XDR. The technique leverages dynamic execution to load malicious tools into a trusted process context, reducing EDR alerts.

Sophos X-Ops uncovered HeartCrypt, a packer-as-a-service derived from EDRKillShifter, being used by at least eight ransomware groups to disable EDR and AV products before deploying ransomware. The tool injects malicious code into signed executables and uses BYOVD to load a kernel driver that terminates security processes. This represents a significant escalation in ransomware tactics through cybercrime-as-a-service.

A local privilege escalation vulnerability (CVE-2025-7433) was disclosed in Sophos Intercept X for Windows with Central Device Encryption 2025.1 and older. It allows arbitrary code execution via deserialization of untrusted data. Sophos has released patches to address the issue.

A security researcher released LoaderGate, a C# shellcode loader designed to bypass Palo Alto Cortex XDR and Sophos EDR. The tool demonstrates a specific evasion technique and was published with a detailed blog post. It highlights a potential detection gap in these endpoint security products.

A proof-of-concept tool named PatchedCLRLoader demonstrates loading .NET assemblies while bypassing AMSI and ETW by patching functions in clr.dll and ntdll.dll. It uses direct syscalls and RC4 encryption to evade detection, and was tested successfully against Cortex XDR, Sophos, MDE, and CrowdStrike. The technique specifically patches AmsiScanBuffer in clr.dll and NtTraceEvent to avoid newer Windows Defender protections.

Secureworks (a Sophos company) disclosed and fixed a local privilege escalation vulnerability in the Debian package component of Taegis Endpoint Agent for Linux. The flaw allowed arbitrary code execution. Red Hat-based Linux systems using RPM packages were not affected.

A threat actor on the dark web claims to sell a tool that bypasses EDR solutions using advanced cryptographic techniques. The tool reportedly targets CrowdStrike, Sophos, SentinelOne, and FortiClient. This highlights the growing black market for EDR evasion tools.

RustPatchlessCLRLoader is a proof-of-concept tool that loads .NET assemblies while bypassing AMSI and ETW using hardware breakpoints instead of memory patching. It was tested against several EDR products and successfully executed without detection, though behavioral detection may still trigger on malicious actions.

A proof-of-concept tool named SyscallTempering demonstrates a technique to evade EDR detection by tampering with system call arguments. It uses hardware breakpoints and a vectored exception handler to replace spoofed arguments with real ones on unhooked syscalls, successfully launching a payload under Sophos EDR. The method improves upon prior syscall tampering research by randomly selecting benign, unhooked syscalls and spoofing up to 11 arguments.

SentinelOne reports that the Fin7 threat group has developed and sold a custom tool called AvNeutralizer (aka AuKill) that tampers with endpoint detection and response (EDR) solutions. The tool has been used by multiple ransomware gangs, including AvosLocker, MedusaLocker, BlackCat, and LockBit, since early 2023. AvNeutralizer leverages a previously unseen technique using the Windows TTD monitor driver ProcLaunchMon.sys and a hardened process explorer driver to cause a denial-of-service condition on affected security products.

BOAZ is a modular evasion framework that combines signature, heuristic, and behavioral bypass techniques to generate undetectable payloads. It was tested against 14 desktop AVs and 7 EDRs, including Sophos, Windows Defender, and ESET. The tool serves as both an evasion testing utility and a packer/obfuscator for researchers.

A threat actor named Spyboy is selling a tool called Terminator that uses the Bring Your Own Vulnerable Driver (BYOVD) technique to terminate processes of endpoint security products. The tool loads a vulnerable Zemana anti-malware driver to execute code in kernel mode, bypassing user-mode protections. SentinelOne detects known samples, and organizations are advised to review provided indicators of compromise.

Researcher Marcus Hutchins published two novel techniques to bypass EDR user-mode hooks without triggering callstack-based detections. The methods use hardware breakpoints and intentional exceptions to manipulate parameters after EDR inspection, demonstrated against Sophos Intercept X process hollowing detection. A proof-of-concept is available on GitHub.

A red teamer documents their process of evading EDR detection for a Meterpreter payload by applying XOR encryption and storing the encrypted shellcode in the .data section to reduce static signatures. The technique was tested against Sophos XDR Intercept and Microsoft Defender for Endpoint on Windows 11, aiming to run the payload with minimal alerts. The article is part one of a series, focusing on theoretical foundations and initial evasion attempts.

A technical analysis of the AuKill malware, which uses a Bring Your Own Vulnerable Driver (BYOVD) technique with the PROCEXP.SYS driver to terminate protected EDR processes. The malware targets solutions like Sophos and Windows Defender, and has been used by ransomware groups including LockBit and Medusa.

A video and Reddit post surfaced on May 28, 2023, showing an executable that allegedly disables tamper protection and terminates the on-premise agents of numerous endpoint security products. The tool claims to work against vendors including CrowdStrike, SentinelOne, Carbon Black, and Windows Defender. ThreatLocker notes that its application allowlisting would block such an unknown executable from running.

A threat actor is selling a tool called Terminator that uses a Bring Your Own Vulnerable Driver (BYOVD) attack to terminate antivirus, EDR, and XDR processes. The tool drops a legitimate but vulnerable Zemana anti-malware driver (zamguard64.sys or zam64.sys) to gain kernel-level privileges and kill security software user-mode processes. CrowdStrike confirmed the technique is a BYOVD attack, not a novel bypass.