TangleCrypt Windows Packer with Ransomware Payloads Evades EDR Using ABYSSWORKER Driver

TangleCrypt is a newly observed Windows packer used in a September 2025 Qilin ransomware incident that conceals payloads through layered base64 encoding, LZ78 compression and XOR encryption; it supports in-process and suspended-child process execution modes and was used to deliver the STONESTOP EDR‑killer and ABYSSWORKER driver to disable security products before encryption.