A brand new evaluation has uncovered connections between associates of RansomHub and different ransomware teams like Medusa, BianLian, and Play.
The connection stems from using a customized device that is designed to disable endpoint detection and response (EDR) software program on compromised hosts, in line with ESET. The EDR killing device, dubbed EDRKillShifter, was first documented as utilized by RansomHub actors in August 2024.
EDRKillShifter accomplishes its targets by way of a identified tactic referred to as Convey Your Personal Susceptible Driver (BYOVD) that entails utilizing a authentic however susceptible driver to terminate safety options defending the endpoints.
The concept with utilizing such instruments is to make sure the sleek execution of the ransomware encryptor with out it being flagged by safety options.
“Throughout an intrusion, the purpose of the affiliate is to acquire admin or area admin privileges,” ESET researchers Jakub Souček and Jan Holman mentioned in a report shared with The Hacker Information.
“Ransomware operators have a tendency to not do main updates of their encryptors too usually because of the danger of introducing a flaw that would trigger points, finally damaging their repute. In consequence, safety distributors detect the encryptors fairly properly, which the associates react to through the use of EDR killers to ‘eliminate’ the safety resolution simply earlier than executing the encryptor.”
What’s notable right here is {that a} bespoke device developed by the operators of RansomHub and supplied to its associates – one thing of a uncommon phenomenon in itself – is being utilized in different ransomware assaults related to Medusa, BianLian, and Play.
This facet assumes particular significance in gentle of the truth that each Play and BianLian function below the closed RaaS mannequin, whereby the operators will not be actively seeking to rent new associates and their partnerships are primarily based on long-term mutual belief.
“Trusted members of Play and BianLian are collaborating with rivals, even newly emerged ones like RansomHub, after which repurposing the tooling they obtain from these rivals in their very own assaults,” ESET theorized. “That is particularly fascinating, since such closed gangs sometimes make use of a fairly constant set of core instruments throughout their intrusions.”
It is being suspected that each one these ransomware assaults have been carried out by the identical risk actor, dubbed QuadSwitcher, who is probably going associated to Play the closest owing to similarities in tradecraft sometimes related to Play intrusions.
EDRKillShifter has additionally been noticed being utilized by one other particular person ransomware affiliate referred to as CosmicBeetle as a part of three totally different RansomHub and faux LockBit assaults.
The event comes amid a surge in ransomware assaults utilizing BYOVD strategies to deploy EDR killers on compromised techniques. Final yr, the ransomware gang referred to as Embargo was found utilizing a program referred to as MS4Killer to neutralize safety software program. As not too long ago as this month, the Medusa ransomware crew has been linked to a customized malicious driver codenamed ABYSSWORKER.
“Risk actors want admin privileges to deploy an EDR killer, so ideally, their presence must be detected and mitigated earlier than they attain that time,” ESET mentioned.
“Customers, particularly in company environments, ought to make sure that the detection of doubtless unsafe purposes is enabled. This will forestall the set up of susceptible drivers.”
