Loading malware…
NtKiller is a commercially promoted Windows security-disabling tool advertised on underground cybercrime forums by the threat actor AlphaGhoul. It is marketed as a utility that can stealthily and silently terminate antivirus and endpoint detection tools to help attackers avoid detection while running malware on compromised systems. Advertised targets include Microsoft Defender, ESET, Kaspersky, Bitdefender, Trend Micro, and, in broader reporting, Avast, Norton, AVG, Malwarebytes, and Dr. Web. The tool is positioned as part of the growing market for so-called EDR/AV killer tooling used prior to follow-on malicious activity such as malware staging and ransomware deployment.
According to the provided reporting, NtKiller is sold with a $500 core build and optional $300 add-ons for a rootkit module and a silent UAC bypass. It explicitly advertises support for HVCI/VBS, Memory Integrity, advanced persistence, and Cobalt Strike integration. Additional described capabilities include early-boot persistence, anti-debugging, anti-analysis protections, and aggressive modes that allegedly bypass enterprise-grade EDR solutions. The content also states that NtKiller supports advanced evasion techniques involving HVCI disabling, VBS manipulation, and memory integrity circumvention.
NtKiller is associated with AlphaGhoul and is marketed for commercial sale to cybercriminals. The reporting places it within a broader ecosystem of tools that disable endpoint protections before subsequent attacker actions. However, the actual effectiveness of NtKiller has not been independently verified by third-party researchers in the provided content.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 distinct techniques documented for this family, organized by ATT&CK tactic.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A premium underground EDR killer with optional rootkit and UAC bypass modules, marketed for disabling security products and integrating with post-exploitation tooling.
Tool designed to stealthily terminate antivirus and security solutions, with optional rootkit and UAC bypass capabilities.
NtKiller is a malicious tool designed to disable antivirus and endpoint detection and response (EDR) solutions, bypass security controls (including UAC), and maintain persistence through early-boot mechanisms. It offers advanced evasion features such as rootkit capabilities, HVCI disabling, VBS manipulation, and anti-analysis protections, making it a potent tool for attackers to evade detection and maintain stealthy access.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.