RansomHub introduces EDRKillShifter detection evasion tool

RansomHub ransomware, known for its partner scheme and use of EDR disabling methods to avoid detection and persist on compromised devices or networks, now uses EDRKillShifter

See also: RansomHub group leaked Kawasaki Motors data

Experts discovered that Ransomhub incorporated EDRKillShifter into its attack chain, a new method of evading detection.

The purpose of EDRKillShifter is to exploit vulnerable drivers and undermine the effectiveness of EDR solutions by using methods to avoid detection and interfere with security.

Trend Micro identified this group as Water Bakunawa, which is responsible for the RansomHub ransomware and uses various anti-EDR tactics to play a game of hide-and-seek with security solutions.

RansomHub has been linked to ransomware attacks on industries and critical infrastructure such as water and wastewater, IT, commercial and government services and facilities, healthcare, agriculture, financial services, manufacturing, transportation, and communications.

See also: RansomHub: Uses Kaspersky's TDSSKiller to disable EDR solutions

Experts say that RansomHub's EDRKillShifter dynamically interrupts security processes in real time and advances over standard EDR solutions by modifying its techniques as detection capabilities improve.

EDRKillShifter's EDR disabling capabilities integrate seamlessly into the attack chain, ensuring that all phases of an attack utilize them and enhancing overall effectiveness.

These developments turn EDRKillShifter into a powerful RansomHub weapon against traditional endpoint security systems, requiring enterprises to implement more resilient and flexible security measures.

The RansomHub ransomware also exploits the Zerologon vulnerability (CVE-2020-1472). Researchers said that if left unpatched, it could allow attackers to take over an entire network without requiring authentication.

See also: NoName ransomware: “Collaboration” with the RansomHub group?

Ransomware attacks are one of the most dangerous cybersecurity threats of our time. These attacks occur when malicious software infiltrates a system, encrypts data, and then demands a specific payment to restore access. The purpose of these attacks is financial, and they often target organizations and businesses because of the potentially higher ransom amount they can pay. Countering ransomware attacks requires strong security measures, such as regular data backups, updated systems , and training employees to avoid suspicious emails and applications.

Source: cybersecuritynews