New Crypto24 Ransomware Attacks Bypass EDR

Trend Micro researchers warn of an active Crypto24 ransomware campaign that demonstrates advanced technical capabilities — including a customized RealBlindingEDR tool that neutralizes callbacks for nearly 30 security vendors, use of legitimate admin utilities (PSExec, AnyDesk, gpscript.exe, XBCUninstaller.exe) for post‑compromise actions, and likely use of vulnerable drivers (BYVOD) to evade EDRs — with big‑game hunting targeting large enterprises across financial services, manufacturing, entertainment, and tech in Asia, Europe, and the US.