RansomHub Rolls Out Brand-New, EDR-Killing BYOVD Binary

RansomHub has deployed a new loader called EDRKillShifter that decrypts and runs an embedded payload which drops and exploits vulnerable signed drivers to escalate privileges and unhook EDR protections (a bring-your-own-driver/BYOVD technique). Sophos X-Ops links the tool to a broader rise in EDR-killer malware (e.g., AuKill, Terminator) and recommends enforcing Windows security role hygiene and separation of user/admin privileges to mitigate these attacks.