Russia’s FIN7 is peddling its EDR-nerfing malware to ransomware gangs

SentinelOne research links the FIN7 cybercrime syndicate to AvNeutralizer, a commercially marketed tool that disables EDR/antivirus products; FIN7 operatives allegedly sell customized builders (targeting specific EDRs) to other ransomware actors for $4,000–$15,000. The report details AvNeutralizer’s evolution (including a technique abusing ProcLaunchMon.sys), its use by multiple RaaS families since 2022–2023, the group’s use of pseudonyms and front companies to obfuscate attribution, and the operational impact of these EDR-bypass capabilities.