MalwareUsed by 1 actor

PowerTool

PowerTool, also referred to as KillAV, is a Windows defense-evasion utility used to disable endpoint security products. It abuses a legitimate Zemana AntiMalware kernel driver to obtain kernel-level capability for terminating antivirus and EDR-related processes, consistent with a bring-your-own-vulnerable-driver technique. PowerTool has been observed in Akira ransomware intrusions and in Qilin-related post-compromise activity, where it is deployed after initial access to weaken endpoint defenses and facilitate subsequent ransomware operations.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Qilin

CTU researchers have observed remote desktop protocol (RDP) abused for initial access and lateral movement before the post-compromise PCHunter and PowerTool tools were deployed, possibly with the intention of disabling antivirus software.

via secureworks threat profilessecureworks.com

MITRE ATT&CK

Techniques & procedures

4 distinct techniques documented for this family, organized by ATT&CK tactic.

Stealth

2 techniques

T1070.001Clear Windows Event LogsEvidence1

For defense evasion, tools such as GMER, IOBit, and PowerTool are deployed to disable endpoint protection and clear event logs.

T1070.004File DeletionEvidence1

The threat actor was observed deleting files that had been dropped to disk.

Other

2 techniques

T1562Impair DefensesEvidence6

Unit 42 researchers observed Royal ransomware operators using PowerTool. This is a piece of software that has access to the kernel and is ideal for removing endpoint security software. They also executed batch scripts to disable security-related services

T1562.001Disable or Modify ToolsEvidence4

“PowerTool or KillAV tool abuses Zemana AntiMalware driver to terminate AV/EDR processes at kernel level... Disables Windows Defender via PowerShell.”

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

shroudcloudNews

Apr 14, 2026

Akira - ShroudCloud

A defense-evasion tool reportedly used by Akira operators to abuse the vulnerable Zemana AntiMalware driver and terminate AV/EDR processes at kernel level.

security affairsNews

Apr 21, 2024

Akira ransomware received $42M in ransom payments from over 250 victims

Tool used by Akira operators for defense evasion by exploiting the Zemana AntiMalware driver to terminate antivirus-related processes.

secureworks threat profilesNews

Mar 18, 2026

GOLD FEATHER

Post-compromise tool observed in Qilin intrusions, possibly used to disable antivirus/endpoint protections ahead of ransomware execution.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping4

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

PowerTool