Loading story…
Volexity reported on malware engineered to nullify endpoint detection and response (EDR) protections, highlighting how attackers can tamper with security tooling in ways that reduce visibility on compromised systems. The report focuses on using memory analysis to uncover malicious activity that may not be obvious through standard endpoint telemetry, especially when defensive agents have been impaired or bypassed.
The findings underscore that volatile memory can preserve evidence of attacker behavior, injected code, and interference with security products even after conventional detection paths have been weakened. For defenders, the case demonstrates that incident response and threat hunting should include memory forensics when EDR tampering is suspected, because malware built to disable monitoring can otherwise leave organizations blind during an active intrusion.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Volexity published a blog post describing how memory analysis can be used to detect malware designed to disable or evade endpoint detection and response tools. The reference does not provide earlier incident dates or additional discrete events beyond the publication itself.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Huntress reported an intrusion in which attackers deployed a custom **EDR killer** that disables endpoint security by abusing a legitimate but long-revoked kernel driver originally shipped with Guidance Software’s *EnCase* forensics product. The malware embeds the vulnerable driver (reported as `EnPortv.sys`) and uses a **Bring Your Own Vulnerable Driver (BYOVD)** approach: once the driver is loaded, it exposes an `IOCTL` interface that enables user-mode code to terminate arbitrary processes from kernel mode, bypassing user-mode protections including **Protected Process Light (PPL)**. The tool is described as capable of targeting **59** endpoint security products. In the observed incident, initial access was achieved by successfully authenticating to **SonicWall SSL VPN** using previously compromised credentials, with reporting noting the absence of **MFA** on the VPN account. Post-compromise activity included internal reconnaissance (e.g., ICMP ping sweeps, NetBIOS/SMB probing) and high-rate SYN activity, followed by execution of the EDR killer disguised as a legitimate utility (e.g., a firmware update tool). The malware reportedly uses a custom encoding scheme to conceal the embedded driver, writes it to disk under an OEM-like path, hides it, timestomps it to blend in, and registers it as a Windows kernel service for persistence; despite the driver’s certificate being expired and revoked for years, Windows can still load it due to signature verification and timestamping behavior.
Jul 4, 2026
A new security threat has emerged with the discovery of the EDR-Freeze tool, which targets Endpoint Detection and Response (EDR) and antivirus solutions by exploiting a vulnerability in the Windows Error Reporting (WER) system. The tool, developed by Zero Salarium, leverages a specific flaw in WER to suspend or incapacitate security processes, effectively putting EDR and antivirus software into a 'coma state.' This technique allows attackers to bypass critical security controls, increasing the risk of undetected malicious activity on compromised systems. Security researchers have highlighted the cleverness of this attack, noting that it can be used to facilitate further exploitation or persistence by threat actors. In response to the identification of EDR-Freeze, the detection engineering community has rapidly developed and deployed new detection rules across multiple platforms. SigmaHQ and Yamato-Security have both updated their Sigma and Hayabusa rule sets to specifically identify the abuse of WerFaultSecure.exe, which is central to the EDR-Freeze technique. These rules are designed to detect the suspension of security processes, a hallmark of the EDR-Freeze attack. The rapid integration of these detection rules demonstrates the agility of the security community in responding to emerging threats. Additionally, the new rules are being incorporated into a variety of detection platforms, including Elastic, YARA, and KQL, to ensure broad coverage across different security environments. The focus on defense evasion tactics in recent detection rule updates underscores the growing sophistication of attackers and the need for continuous improvement in security monitoring. Organizations are advised to update their detection content to include these new rules and to monitor for suspicious activity involving WerFaultSecure.exe. The incident has also prompted discussions about the need for more robust protections within the Windows Error Reporting system to prevent similar abuses in the future. Security teams are encouraged to review their endpoint security configurations and ensure that their EDR and antivirus solutions are resilient against process suspension attacks. The EDR-Freeze case highlights the importance of collaboration between security researchers, detection engineers, and vendors in rapidly addressing new attack techniques. As attackers continue to innovate, defenders must remain vigilant and proactive in adapting their detection and response strategies. The emergence of EDR-Freeze serves as a reminder that even trusted system components like WER can be weaponized by adversaries. Ongoing threat intelligence sharing and rule development are critical to maintaining effective defenses against evolving threats. The security community's swift response to EDR-Freeze demonstrates the value of open-source detection rule repositories and collaborative defense efforts.
Jun 29, 2026
**ESET Research** reported that **EDR killers** have become a standard component of modern ransomware operations, with attackers routinely disabling endpoint detection and response tools before launching encryptors. Across nearly 90 EDR killer tools observed in the wild, 54 were found to use the **Bring Your Own Vulnerable Driver (BYOVD)** technique, abusing 34 signed but vulnerable drivers to obtain kernel-level privileges and tamper with security products. The research says this approach is especially attractive to ransomware affiliates because it creates a short, reliable window for encryption while avoiding the need to constantly rebuild encryptors to evade detection. The reporting also highlights how **ransomware-as-a-service** operations contribute to the diversity of EDR killer tooling: operators typically provide the encryptor and infrastructure, while affiliates choose the EDR-disabling utility used during an intrusion. Although BYOVD remains the dominant method because of its reliability and relatively low development cost, researchers also observed a growing set of tools that disable protections without loading drivers, including methods that disrupt EDR communications, suspend processes, or abuse built-in administrative utilities. The findings reinforce that vulnerable-driver abuse remains a key defensive gap, while non-kernel alternatives are also expanding the range of pre-encryption attack techniques defenders must monitor.
Jul 12, 2026