Ransomware Gangs Expand Use of EDR Killers Beyond Vulnerable Drivers, ESET Warns

ESET Research documents a rapidly expanding ecosystem of "EDR killers"—techniques and tools attackers use to disable endpoint detection and response before deploying ransomware—tracking almost 90 families (54 abusing vulnerable drivers across 35 drivers) and noting the rise of driverless methods, script-based approaches, legitimate anti-rootkit misuse, and commercialized "EDR killer as a service" offerings; this diversification, driven by affiliates, closed developer groups, and PoC reuse, complicates attribution and means defenders should prioritize behavioral detection of security tampering over tracking individual vulnerable drivers.