Loading threat actor…
SpyBoy, also styled Spyboy, is a threat actor known for developing and selling Terminator, a Windows security-disabling tool marketed on Russian-speaking hacking forums beginning in May 2023. The actor advertised prices ranging from $300 for a product-specific bypass to $3,000 for an all-in-one package. Terminator uses a bring-your-own-vulnerable-driver (BYOVD) technique involving a legitimate, signed Zemana anti-malware kernel driver. It exploits vulnerable driver functionality to terminate antivirus and endpoint detection and response processes with kernel-level privileges. The Zemana arbitrary process termination vulnerability incorporated into the tool is identified as CVE-2024-1853. Running Terminator requires existing administrative privileges and approval of a User Account Control prompt. Its principal capability is defense evasion through disabling endpoint security software; advertised claims of broad product coverage are not independently established. SpyBoy's sale of Terminator does not establish affiliation with Qilin or other ransomware operators.
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
1 malware family Mallory has associated with this actor across public reporting.
1 CVE Mallory has associated with this actor across public reporting. 1 of them is exploited in the wild (not necessarily by this actor).
5 indicators attributed to this actor. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.