NtKiller
NtKiller is a malware/tool advertised on underground cybercriminal forums by the threat actor AlphaGhoul. It is promoted as a stealthy utility for silently terminating antivirus and endpoint detection and response products in order to help attackers evade detection while running malware on compromised systems. According to the provided reporting, NtKiller claims compatibility against major security products including Microsoft Defender, ESET, Kaspersky, Bitdefender, and Trend Micro, and is also advertised as capable of bypassing enterprise-grade EDR solutions in aggressive modes. Reported capabilities include early-boot persistence, anti-debugging and anti-analysis protections, HVCI disabling, VBS manipulation, memory integrity circumvention, and a silent UAC bypass feature for privilege escalation. A rootkit capability is offered as an add-on. The tool is described as being sold commercially within the cybercriminal ecosystem with modular pricing, including $500 for core functionality and additional charges for rootkit and UAC bypass features. KrakenLabs analysts reportedly examined the tool, but its real-world effectiveness has not been independently verified. The content does not provide specific infection vectors, victim sectors, platforms beyond infected computers/endpoint environments, or concrete indicators of compromise.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Tool designed to stealthily terminate antivirus and security solutions, with optional rootkit and UAC bypass capabilities.
NtKiller is a malicious tool designed to disable antivirus and endpoint detection and response (EDR) solutions, bypass security controls (including UAC), and maintain persistence through early-boot mechanisms. It offers advanced evasion features such as rootkit capabilities, HVCI disabling, VBS manipulation, and anti-analysis protections, making it a potent tool for attackers to evade detection and maintain stealthy access.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.