Loading malware…
Terminator is a Windows endpoint-security disabling tool marketed by the threat actor Spyboy beginning in May 2023. It uses bring-your-own-vulnerable-driver (BYOVD) techniques to terminate antivirus and endpoint detection and response processes, facilitating subsequent malicious activity, including ransomware deployment.
Terminator loads legitimately signed but vulnerable Zemana Anti-Malware or Anti-Logger kernel drivers and abuses their privileged process-termination functionality. The vulnerable driver interface allows an attacker-controlled process to register itself as trusted and then request termination of targeted security processes. Deployment requires administrative privileges, with elevation subject to Windows User Account Control. Its use of a signed driver does not make the activity legitimate or guarantee that endpoint protections can be disabled; observed attempts have been blocked by security products.
Terminator has been observed in intrusions associated with Akira, Qilin, and BlackCat/ALPHV ransomware. Public implementations and related variants include an open-source Terminator project, the C# implementation SharpTerminator, and the Nim implementation Ternimator. Attackers have modified or packed public implementations to hinder detection. Terminator primarily serves as a post-compromise defense-evasion utility rather than an initial-access mechanism.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
In May 2023, a threat actor with the pseudonym “SpyBoy” incorporated this vulnerability into a tool named “Terminator,” marketed as an "EDR killer" tool.
“Spyboy’s Terminator tool [is] used to bypass AVs and EDRs.”
8 distinct techniques documented for this family, organized by ATT&CK tactic.
or they would need to convince a user to install the driver via social engineering
it utilised a signed kernel driver file taken from the Zemana Anti-Malware program to perform privileged operations, which is commonly referred to as a Bring Your Own Vulnerable Driver (BYOVD) attack.
To abuse the driver in this way, however, a threat actor would need administrative privileges and a User Account Control (UAC) bypass
In some cases, threat actors also ported the open-source projects discussed earlier to different languages or obfuscated them through packers to circumvent detection.
"...drops the legitimate, signed Zemana anti-malware kernel driver... into the C:\Windows\System32\ folder with a random name between 4 and 10 characters."
Upon execution, the binary loads the “BINARY” resource. The content is decrypted via AES-256. The key is hardcoded in the binary. Finally, the binary writes the decrypted content into a newly allocated section and executes it.
Finally, the binary writes the decrypted content into a newly allocated section and executes it.
T1562.001 Disable or Modify Tools (Defense Evasion) — терминация EDR-агентов и антивирусных процессов после получения доступа к Ring 0
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.