A brand new evaluation has uncovered connections between associates of RansomHub and different ransomware teams like Medusa, BianLian, and Play.
The connection stems from using a customized software that is designed to disable endpoint detection and response (EDR) software program on compromised hosts, in accordance with ESET. The EDR killing software, dubbed EDRKillShifter, was first documented as utilized by RansomHub actors in August 2024.
EDRKillShifter accomplishes its targets by the use of a identified tactic known as Deliver Your Personal Weak Driver (BYOVD) that entails utilizing a respectable however weak driver to terminate safety options defending the endpoints.
The concept with utilizing such instruments is to make sure the graceful execution of the ransomware encryptor with out it being flagged by safety options.
“Throughout an intrusion, the objective of the affiliate is to acquire admin or area admin privileges,” ESET researchers Jakub Souček and Jan Holman said in a report shared with The Hacker Information.
“Ransomware operators have a tendency to not do main updates of their encryptors too typically because of the threat of introducing a flaw that might trigger points, finally damaging their popularity. Because of this, safety distributors detect the encryptors fairly effectively, which the associates react to through the use of EDR killers to ‘do away with’ the safety answer simply earlier than executing the encryptor.”
What’s notable right here is {that a} bespoke software developed by the operators of RansomHub and supplied to its associates – one thing of a uncommon phenomenon in itself – is being utilized in different ransomware assaults related to Medusa, BianLian, and Play.
This facet assumes particular significance in mild of the truth that each Play and BianLian function below the closed RaaS mannequin, whereby the operators usually are not actively seeking to rent new associates and their partnerships are primarily based on long-term mutual belief.
“Trusted members of Play and BianLian are collaborating with rivals, even newly emerged ones like RansomHub, after which repurposing the tooling they obtain from these rivals in their very own assaults,” ESET theorized. “That is particularly fascinating, since such closed gangs usually make use of a relatively constant set of core instruments throughout their intrusions.”
It is being suspected that each one these ransomware assaults have been carried out by the identical menace actor, dubbed QuadSwitcher, who is probably going associated to Play the closest owing to similarities in tradecraft usually related to Play intrusions.
EDRKillShifter has additionally been noticed being utilized by one other particular person ransomware affiliate referred to as CosmicBeetle as a part of three completely different RansomHub and pretend LockBit assaults.
The event comes amid a surge in ransomware assaults utilizing BYOVD techniques to deploy EDR killers on compromised programs. Final yr, the ransomware gang referred to as Embargo was found utilizing a program known as MS4Killer to neutralize safety software program. As not too long ago as this month, the Medusa ransomware crew has been linked to a customized malicious driver codenamed ABYSSWORKER.
“Menace actors want admin privileges to deploy an EDR killer, so ideally, their presence ought to be detected and mitigated earlier than they attain that time,” ESET mentioned.
“Customers, particularly in company environments, ought to be certain that the detection of probably unsafe functions is enabled. This could forestall the set up of weak drivers.”
