MS4Killer
MS4Killer is a Rust-based endpoint detection and response (EDR) killer associated with the Embargo ransomware operation. ESET documented it in 2024 and named it for its similarities to the publicly available s4killer proof of concept; reporting states it was implemented by modifying or drawing inspiration from that PoC. MS4Killer is part of Embargo’s Rust-written toolchain alongside the MDeployer loader and the Embargo ransomware payload.
Its primary role is defense evasion prior to ransomware execution. Embargo has used MS4Killer to deliver a vulnerable driver in a Bring Your Own Vulnerable Driver (BYOVD) attack, specifically probmon.sys version 3.0.0.4, signed with a revoked certificate from ITM System Co., LTD. MS4Killer performs process discovery, captures snapshots of active processes via CreateToolHelp32Snapshot(), enumerates active services via OpenSCManagerW() and EnumServicesStatusExW(), and terminates targeted processes and services based on hardcoded lists, including an embedded XOR-encrypted list of security software processes. Reporting states it was used to terminate security products including SentinelOne, Cylance, ESET, Defender, Bitdefender, Kaspersky, and Webroot. One source also states MS4Killer is custom-compiled for each victim environment to disable selected security solutions.
Within Embargo intrusions, MDeployer decrypts and launches the MS4Killer payload, identified as b.cache, and the Embargo ransomware executable, identified as a.cache, using a hardcoded RC4 key. Related activity includes use of the hardcoded mutex names IntoTheFloodAgainSameOldTrip and LoadUpOnGunsBringYourFriends. MS4Killer has been used together with other Embargo tradecraft such as Safe Mode abuse, registry modification, BAT scripts to weaken defenses, and subsequent ransomware deployment. After execution, MDeployer has been observed terminating the MS4Killer process, deleting decrypted payload files and the dropped driver, and rebooting the system.
MS4Killer is directly tied in the provided reporting to Embargo, also tracked as Storm-0501 in broader campaign reporting, and is used in attacks that culminate in double-extortion ransomware deployment against victim organizations, including notable targeting of U.S. organizations and sectors such as healthcare, technology, business services, and manufacturing.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
At the time, Embargo relied on two EDR killers: a custom Safe Mode script, leveraging the technique already described earlier, and MS4Killer, a tool inspired by the publicly available s4killer PoC.
Entire toolchain written in Rust - ransomware, loader (MDeployer), and EDR killer (MS4Killer).
Techniques & procedures
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
1 technique
Execution
Persistence
2 techniques
Persistence
Privilege Escalation
3 techniques
Privilege Escalation
Stealth
5 techniques
Stealth
Commercial EDR killers especially use obfuscation and encryption (e.g., CardSpaceKiller).
Some EDR killers embed the drivers directly into their user-mode components, often encrypted.
Embargo has encrypted both MDeployer and MS4 Killer payloads with RC4.
Discovery
1 technique
Discovery
Impact
1 technique
Impact
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Rust-based BYOVD EDR killer used with Embargo. It decrypts and loads a vulnerable driver (probmon.sys), creates kernel services, and continuously terminates victim-specific security products such as SentinelOne, Cylance, ESET, Defender, Bitdefender, Kaspersky, and Webroot.
EDR killer used by Embargo; based on the s4killer PoC but modified with parallelism, altered code flow, and encrypted strings and embedded driver.
Toolkit used alongside Embargo to disable or terminate security software and processes, enumerate processes, and deploy a vulnerable driver as part of BYOVD activity to facilitate ransomware execution.
Custom-compiled per victim to target selected security solutions and attempt to disable them, facilitating ransomware execution.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.