In August 2025, Sophos X-Ops exposed a sophisticated EDR killer campaign leveraging the HeartCrypt packer-as-a-service to disable endpoint defenses ahead of ransomware execution. Initially linked to RansomHub, the tool has since been adopted and adapted by multiple ransomware groups, showing evidence of cross-group knowledge sharing and tool evolution. By abusing stolen or expired code-signing certificates, the attackers load malicious drivers capable of terminating security processes from a wide range of vendors, clearing the way for encryption and data theft.
Severity Level: High
Threat Overview
Origins and Evolution
- Developed by RansomHub, replacing the earlier EDRKillShifter tool.
- Distributed as different custom builds, all protected with HeartCrypt packing for evasion.
- Indicators suggest a mature underground tool market and possible technical collaboration across ransomware groups.
Execution Flow
- Dropped by a loader or bundled within trojanized legitimate software (e.g., Beyond Compare Clipboard Compare tool).
- Unpacks and loads a malicious kernel driver, often named differently per sample (mraml.sys, noedt.sys), with the filename hardcoded.
- Driver is signed with compromised or expired digital certificates (e.g., Changsha Hengxiang Information Technology, Fuzhou Dingxin Trade).
Capabilities
- Terminates security processes and services, such as MsMpEng.exe, SophosHealth.exe, SAVService.exe, and sophosui.exe.
- Targets multiple security vendors: Bitdefender , Cylance, Fset, F-Secure, Fortinet, McAfee, HitManPro, Kaspersky, Microsoft, SentinelOne, Sophos, Symantec, Trend Micro, Webroot
- Driver masquerades as legitimate software (e.g., CrowdStrike Falcon Sensor Driver) but contains malicious routines for process termination.
Ransomware Associations
- Used in campaigns by RansomHub, Qilin, MedusaLocker, DragonForce, INC, and others.
- In several cases, the EDR killer was deployed immediately before ransomware encryption, sometimes via zero-day exploitation (e.g., SimpleHelp RCE).
- Observed with layered packing for additional stealth in more recent incidents.
Recommendations
- Patch known vulnerabilities in remote access/support software, especially SimpleHelp and similar platforms.
- Enforce strict driver signature verification, blocking drivers signed with revoked, expired, or untrusted certificates.
- Alert on detection of mass security tool termination attempts.
- Enable application allowlisting to prevent execution of unapproved binaries in sensitive environments.
- Train analysts to recognize driver abuse patterns and abnormal process/service terminations.
- Conduct simulated attacks in red-team exercises to test response to EDR tampering.
- Block the IOCs at their respective controls
https://www.virustotal.com/gui/collection/ffb7aba29f182b8eb74731c4cad1420a87ad5c80b7cc261c9e3ca1abfa544fa1/iocs
Source:
- https://news.sophos.com/en-us/2025/08/06/shared-secret-edr-killer-in-the-kill-chain/
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.