Loading story…
Multiple ransomware groups have begun leveraging a new packer-as-a-service platform called Shanya Crypter to bypass endpoint detection and response (EDR) solutions. Shanya Crypter utilizes kernel driver abuse to terminate EDR processes, making ransomware payloads significantly harder to detect and stop. The service provides custom wrappers for each customer, employing unique encryption algorithms and memory injection techniques that avoid writing payloads to disk, further complicating detection by traditional security tools. Notable ransomware groups such as Medusa, Qilin, Crytox, and Akira have been confirmed to use Shanya, with attacks observed in regions including Tunisia, the UAE, Costa Rica, Nigeria, and Pakistan.
The emergence of Shanya Crypter marks a significant evolution in ransomware delivery tactics, as it enables threat actors to deploy EDR-killing payloads with greater stealth and efficiency. Security researchers have highlighted the technical sophistication of Shanya, including its use of non-standard module loading and the ability to generate unique stubs for each customer. This development underscores the ongoing arms race between ransomware operators and defenders, with attackers increasingly turning to advanced packing and obfuscation services to maintain the effectiveness of their campaigns.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Sophos publicly released technical details on how Shanya works, including its use of memory-mapped legitimate DLLs, anti-debugging measures, DLL side-loading tradecraft, and the driver-based EDR killer chain. The report also provided indicators of compromise to help defenders detect related activity.
By early December 2025, researchers reported that ransomware groups including Medusa, Qilin, Crytox, and Akira were using Shanya-packed DLLs in side-loading attacks to deploy payloads that disable endpoint detection and response products. The attacks used legitimate Windows components and abused drivers such as signed ThrottleStop.sys and unsigned hlpdrv.sys to gain privileges and interfere with security software.
Sophos observed Shanya being used not only by ransomware operators but also in other malware activity, including ClickFix campaigns delivering CastleRAT. This showed the service was being adopted across multiple types of criminal operations.
Shanya emerged in late 2024 as a packer-as-a-service platform used to obfuscate malware payloads with custom encryption, compression, and anti-analysis techniques. It was designed to make malicious files harder for security tools and analysts to detect and inspect.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos reported on **Shanya**, a **packer-as-a-service** offering that helps threat actors conceal malicious payloads and complicate detection during intrusions. The service is designed to wrap malware in layers of obfuscation so it can evade static analysis, frustrate reverse engineering, and reduce the effectiveness of signature-based defenses, making it attractive to a range of operators seeking to improve delivery and execution success. The report indicates Shanya is part of the broader criminal ecosystem that commercializes offensive tooling for affiliates and other attackers, lowering the barrier to entry for malware deployment. By outsourcing packing and evasion capabilities to a dedicated service, adversaries can more easily refresh payloads, bypass security controls, and sustain campaigns with less in-house development effort, reinforcing the role of malware-packaging services in modern attack chains.
Jun 29, 2026
Ransomware operators have been observed using **bring-your-own-vulnerable-driver (BYOVD)** techniques and custom anti-security tools to shut down endpoint protections before encrypting enterprise networks. Kaspersky documented a MedusaLocker intrusion in Brazil in which attackers accessed an SMTP server over RDP with valid administrative credentials, used **Mimikatz** to extract NTLM hashes, and moved laterally with pass-the-hash via PowerShell-based WMI and SMB execution before deploying a new AV-killer tool, `All.exe`. That tool loaded a renamed **TechPowerUp `ThrottleStop.sys`** driver (`ThrottleBlood.sys`), exploited vulnerable IOCTLs for physical memory read/write, hijacked kernel execution through `NtAddAtom`, and repeatedly terminated products from Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Symantec, Bitdefender, ESET, Avast, AVG, McAfee, Panda, Quick Heal, and Kaspersky; the driver issue was assigned **`CVE-2025-7771`**. A separate report on **The Gentlemen** ransomware described a similar pattern in enterprise attacks across the Asia-Pacific region, where the group likely gained entry through an exposed FortiGate device or stolen credentials, then conducted Active Directory reconnaissance, used **PsExec** for lateral movement, established persistence with **AnyDesk**, abused **GPO** and **NETLOGON** for domain-wide deployment, and exfiltrated data with **WinSCP** for double extortion. TrendAI said the group evolved from generic anti-AV tooling to customized variants tailored to the security products installed in each victim environment, while also disabling Windows Defender and recovery mechanisms before dropping `README-GENTLEMEN.txt` and encrypting files with the `.7mtzhh` extension. Together, the incidents show ransomware crews increasingly pairing credential abuse and lateral movement with vulnerable-driver abuse and bespoke defense evasion to maximize encryption success.
Aug 21, 2026
Ransomware operators have repeatedly used tools and policy abuse to disable Microsoft Defender before encrypting Windows environments. DFIR reporting documented the freeware utility **Defender Control** being used in real intrusions by groups such as **Dharma**, **Phobos**, and **Crysis**, typically after access through exposed RDP, to turn off Defender through registry edits, service changes, driver unloading, and local group policy modifications. Separately, **LockBit 2.0** automated the same objective at enterprise scale by creating malicious Active Directory group policies on a domain controller, disabling Defender across domain-joined systems, and launching ransomware via scheduled tasks after enumerating hosts with AD and LDAP queries. More recent intrusions show the tactic evolving beyond simple utilities into **BYOVD** and broader policy abuse. WithSecure reported that the **CrazyHunter** ransomware actor used the vulnerable **Zemana Anti-Logger** driver `zam64.sys` to disable both Windows Defender and Trend Micro during attacks on Taiwanese hospitals and industrial organizations, including the Mackay Memorial Hospital incident. The operation also used publicly available tooling such as **SharpGPOAbuse** for lateral movement and persistence, reinforcing that defense evasion through Defender tampering and group policy manipulation remains a practical, low-barrier technique for ransomware actors ranging from smaller crews to more organized operators.
Aug 14, 2026