Okay, deep breath, let's get this over with. In the grand act of digital self-sabotage, we've littered this site with cookies. Yep, we did that. Why? So your highness can have a 'premium' experience or whatever. These traitorous cookies hide in your browser, eagerly waiting to welcome you back like a guilty dog that's just chewed your favorite shoe. And, if that's not enough, they also tattle on which parts of our sad little corner of the web you obsess over. Feels dirty, doesn't it?
Cybersecurity Panic: EDRKillShifter Tool Targets Endpoint Detection Systems
Cybercrime group RansomHub has unleashed EDRKillShifter, a new tool designed to terminate endpoint detection and response (EDR) software, joining the ranks of other notorious programs. Sophos discovered the tool during a failed ransomware attack, highlighting the evolving tactics of cybercriminals.
Hot Take:
Just when you thought it was safe to go back in the cyber water, RansomHub and its merry band of digital miscreants have unleashed EDRKillShifter, a tool so sneaky it makes Houdini look like an amateur magician. If your EDR software starts acting like it’s on a permanent coffee break, you know who to blame.
Key Points:
- RansomHub gang introduces EDRKillShifter, a new tool for disabling endpoint detection and response (EDR) software.
- EDRKillShifter is a loader executable that uses a ‘bring your own vulnerable driver’ (BYOVD) method.
- Microsoft links RansomHub to the notorious Scattered Spider e-crime syndicate.
- The tool leverages vulnerable drivers to gain elevated privileges and disable EDR software.
- Mitigation strategies include keeping systems updated and separating user and admin privileges.
Already a member? Log in here