Security AlertSubject: Detection of New Malware EDRKillShifterSeverity Level: High Threat Details:Recently, Sophos has published a new list of SHA-256 hashes related to the #بدافزار family EDR Killer.This malware, known as EDRKillShifter, is designed to quickly disable security products including antivirus and EDR systems. Key Capabilities of this Malware:- Disabling organizational defense tools (AV/EDR) in the shortest time.

thereregister.com just posted a very interesting article about how ransomware crews evade EDRs. You can read the full post here: https://www.theregister.com/2025/08/14/edr_killers_ransomware/ In sh...

A new Endpoint Detection and Response (EDR) killer that is considered to be the evolution of 'EDRKillShifter,' developed by RansomHub, has been observed in attacks by eight different ransomware gangs.

A new Endpoint Detection and Response (EDR) killer that is considered to be the evolution of 'EDRKillShifter,' developed by RansomHub, has been observed in attacks by eight different ransomware gangs. [...]

A new Endpoint Detection and Response (EDR) killer that is considered to be the evolution of 'EDRKillShifter,' developed by RansomHub, has been observed in attacks by eight different ransomware gangs.

A new Endpoint Detection and Response (EDR) killer that is considered to be the evolution of 'EDRKillShifter,' developed by RansomHub, has been observed in attacks by eight different ransomware gangs.

ESET researchers take a look back at the significant changes in the ransomware ecosystem in 2024 and focus on the newly emerged and currently dominating ransomware-as-a-service (RaaS) gang, RansomHub. We share previously unpublished insights into RansomHub’s affiliate structure and uncover clear connections between this newly emerged giant and well-established gangs Play, Medusa, and BianLian. We also emphasize the emerging threat of EDR killers, unmasking EDRKillShifter, a custom EDR killer developed and maintained by RansomHub.

EDRKillShifter is an EDR killer targeting a variety of security solutions that the RansomHub operators expect to find.

RansomHub's EDRKillShifter used in 2024 ransomware by Medusa, BianLian, and Play, revealing cross-gang tool sharing.

ESET Research a révélé, il y a quelques jours, comment RansomHub est devenu le leader des ransomwares ces derniers mois, grâce à un outil spécifique et ses connexions avec d'autres groupes criminels majeurs.

LockBitやBlackCatといった巨大グループの失速と入れ替わるように台頭したのが、新興のRaaS（Ransomware-as-a-Service）グループ「RansomHub」です。本記事では、ESETの調査に基づき、RansomHubが提供する独自のEDR を回避するツール「EDRKillShifter」と、その利用を通じて見えてきたMedusa、Play、BianLianといった他のラ...

RansomHub's EDRKillShifter used in 2024 ransomware by Medusa, BianLian, and Play, revealing cross-gang tool sharing.

ESET researchers discover new ties between affiliates of RansomHub and of rival gangs Medusa, BianLian, and Play.

A new analysis has uncovered connections between affiliates of RansomHub and other ransomware groups like Medusa, BianLian, and Play. The connection stems from the use of a custom tool that's designed to disable endpoint detection and response (EDR) software on compromised hosts, according to ESET. The EDR killing tool, dubbed EDRKillShifter, was first documented as used by RansomHub actors in

Wie gefährlich sind EDR-Tötungstools? Entdecken Sie ihre Rolle im Ransomware-Ökosystem und deren Auswirkungen.