Ransomware Groups Exploit Legit IT Tools to Bypass Antivirus

Seqrite research describes a “dual-use dilemma” where legitimate system utilities (like Process Hacker and IOBit Unlocker) are being repurposed by ransomware operators to disable antivirus, gain SYSTEM/kernel-level control, steal credentials, and delete logs—techniques observed across multiple ransomware campaigns (LockBit 3.0, Dharma, Phobos, Makop, MedusaLocker) and increasingly packaged into RaaS kits that may adopt AI-assisted methods.