1 malware family

Spyboy

Also known asSpyboy

Spyboy is a threat actor observed promoting a Windows tool called "Terminator" on a Russian-speaking hacking forum. Spyboy claims the tool can terminate or bypass antivirus, EDR, and XDR products, including Windows Defender, and advertises support for Windows 7 and later. Reported pricing ranged from $300 for a single bypass to $3,000 for an all-in-one bypass. Spyboy also stated that certain EDR bypasses could not be sold individually and included a disclaimer that ransomware and lockers were not allowed. Based on the reporting, Terminator is assessed by CrowdStrike as a Bring Your Own Vulnerable Driver (BYOVD) tool rather than a novel capability. It reportedly requires administrative privileges and user acceptance of a UAC prompt. The tool was reported to drop a legitimate signed Zemana anti-malware kernel driver (zamguard64.sys or zam64.sys) into C:\Windows\System32\ under a random filename, load it, and use the resulting kernel-level privileges to kill user-mode processes belonging to AV and EDR products. The reporting notes that a 2021 proof-of-concept exploit for flaws in the Zemana driver could enable kernel-privileged command execution and could be used to terminate protected security software processes. No additional aliases or sub-groups were provided in the source content.

Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial

MITRE ATT&CK

Tradecraft

5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

2 of 15 tactics4 techniques×N= number of intelligence reports citing this technique

MITRE ATT&CK

TA0004

Privilege Escalation

2 techniques

T1068

Exploitation for Privilege Escalation

T1548

Abuse Elevation Control Mechanism

T1548.002

Bypass User Account Control

TA0005

Stealth

1 technique

T1036

Masquerading

ARSENAL

Associated malware families

1 malware family attributed to this actor across reporting.

FamilyContextEvidenceLast seen

TerminatorA threat actor known as Spyboy is promoting a tool called "Terminator" ... that can allegedly terminate any antivirus, XDR, and EDR platform. However, CrowdStrike says that it's just a fancy Bring Your Own Vulnerable Driver (BYOVD) attack.1Mar 18, 2026

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

bleeping computerNews

May 31, 2023

Terminator antivirus killer is a vulnerable Windows driver in disguise

Promotes and sells an EDR/AV-killer tool (“Terminator”) on a Russian-speaking forum. The tool is described as a BYOVD-style capability that drops and loads a legitimate signed Zemana anti-malware kernel driver to gain kernel privileges and terminate user-mode security processes (AV/EDR/XDR), requiring admin privileges and UAC acceptance on the target.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.

Start free trial

Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping5

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal1

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.

Spyboy

Also known asSpyboy