-
EDR killers are a fundamental part of modern ransomware intrusions; affiliates prefer a short, reliable window to run encryptors rather than constantly modifying payloads.
-
Affiliates, not operators, pick the EDR killers; larger affiliate pools lead to greater tooling diversity.
-
EDR killers implement defense evasion techniques, while encryptors focus purely on encryption.
-
ESET strongly suspects that AI assists with the development of some EDR killers, and researchers provide a concrete example with the Warlock gang.
-
While BYOVD dominates, custom scripts, anti-rootkits, and driverless EDR killers are utilized as well.
BRATISLAVA, Slovakia, March 19, 2026 (GLOBE NEWSWIRE) — ESET Research releases its latest deep dive into the EDR killer ecosystem, disclosing how attackers abuse vulnerable drivers. ESET’s report presents telemetry-backed insights into the environment that move past the commonly seen driver-centric approach. It documents how affiliates, not operators, shape tooling diversity, and how codebases routinely reuse and swap drivers. EDR killers are a fundamental part of modern ransomware intrusions; as such, affiliates prefer a short, reliable window to run encryptors rather than constantly modifying payloads. Furthermore, ESET researchers assess that at least some recently observed EDR killers exhibit traits strongly suggestive of AI-assisted generation. Grounded in ESET telemetry and incident investigations, the research is based on the analysis and tracking of almost 90 EDR killers actively used in the wild.
In recent years, EDR killers have become one of the most commonly seen tools in modern ransomware intrusions: an attacker acquires high privileges, deploys such a tool to disrupt protection, and only then launches the encryptor. Besides the omnipresent Bring Your Own Vulnerable Driver (BYOVD) technique, ESET also sees attackers frequently abusing legitimate anti-rootkit utilities or using driverless approaches to block the communication of endpoint detection and response (EDR) software or suspend it in place. Those abused tools are not just plentiful, but they also behave predictably and consistently, which is precisely why affiliates reach for them.
“The landscape this research unveils is massive, ranging from endless forking of proofs of concept to complex professional implementations. Focusing on commercial EDR killers – advertised on the dark net – allows us to gain a better understanding of their customer base and spot otherwise hidden affiliations. In-house-developed EDR killers offer insight into the inner workings of closed groups. Furthermore, vibe coding is making matters even more complicated,” says ESET researcher Jakub Souček, who investigated the EDR killers.
