KillAV
KillAV is a defense-evasion tool used to disable endpoint security software by deploying vulnerable kernel drivers as part of a Bring Your Own Vulnerable Driver (BYOVD) technique, enabling termination of antivirus/security processes.
It is repeatedly reported in intrusion chains associated with the Medusa ransomware operation (tracked by Symantec as Spearwing; also referred to as Storm-1175), where it is used in “almost all” observed Medusa attacks to help disable security controls prior to or during hands-on-keyboard activity, lateral movement, data exfiltration, and ransomware deployment.
KillAV is also reported in other campaigns using BYOVD for security-tool disruption, including:
- Osiris ransomware activity (Nov 2025), where KillAV was used alongside the POORTRY/Abyssworker driver to disable security tools.
- Jewelbug (aka REF7707 / CL-STA-0049 / Earth Alux) intrusions, where KillAV was used to disable security software, including in a Taiwanese software company intrusion that also involved BYOVD via EchoDrv.
No standalone delivery vector, specific vulnerable driver filenames/hashes, or unique network indicators for KillAV itself are provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In almost all Medusa attacks, KillAV and associated vulnerable drivers are used... to disable security software... Dropping AVKiller and a driver...
Techniques & procedures
1 distinct technique documented for this family, organized by ATT&CK tactic.
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Tool used to disable/kill security software as part of the defensive evasion stage prior to ransomware deployment.
Tool used to deploy (typically) vulnerable drivers to terminate security processes as part of defense evasion in ransomware intrusions.
Tool referenced as used to terminate/disable antivirus processes as part of Medusa-related intrusion activity (BYOVD/defense evasion).
Tool used to disable security software on compromised systems, facilitating further malicious activity.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.