Shifting the sands of RansomHub’s EDRKillShifter

ESET researchers examine the 2024 ransomware landscape and identify RansomHub as an emergent dominant RaaS operator whose affiliates are linked to established gangs (Play, Medusa, BianLian). The report exposes RansomHub’s custom-developed EDR killer, EDRKillShifter, documents a ~15% rise in victims posted on leak sites despite an overall drop in recorded payments, and notes affiliates increasingly reuse public proof-of-concept code while relying on a relatively fixed set of abused drivers.