Russia-linked FIN7 hackers sell their security evasion tool to other groups on darknet

Researchers observed FIN7 developing and selling AvNeutralizer — a customizable EDR/AV evasion tool — on criminal underground forums under multiple aliases; the tool has been used since 2023 in intrusions that deployed several ransomware families (AvosLocker, MedusaLocker, BlackCat, Trigona, LockBit). SentinelOne found advertising for AvNeutralizer with prices between $4,000–$15,000 and noted a new version employing a built-in Windows driver (ProcLaunchMon.sys) and Process Explorer driver to bypass endpoint defenses, indicating active commercialization and wider adoption beyond an initial Black Basta customer.