Hackers Weaponize Legitimate Windows Tools to Disable Antivirus Before Ransomware Attacks

This report explains a trend in modern ransomware operations where attackers repurpose legitimate low-level administrative tools (e.g., Process Hacker, IOBit Unlocker, PowerRun, AuKill) to disable antivirus and EDR prior to deploying ransomware; it outlines a two-stage pattern—defense neutralization and subsequent credential theft/kernel manipulation leading to large-scale file encryption—and recommends controls such as MFA, application whitelisting, registry/audit monitoring, and rapid endpoint isolation.