Notorious FIN7 hackers sell EDR killer to other threat actors

FIN7 (aka Carbanak/Carbon Spider) has developed and sold AvNeutralizer (AuKill), a tool that kills or hangs enterprise endpoint protection by abusing legitimate drivers (ProcLaunchMon.sys and a Process Explorer driver). SentinelOne telemetry and reporting show AvNeutralizer was used across multiple human-operated ransomware intrusions (AvosLocker, MedusaLocker, BlackCat, Trigona, LockBit) and has been sold on Russian-language forums, increasing its distribution; FIN7 also maintains other bespoke backdoors and penetration tools, making the group a high-risk, sophisticated threat to enterprises.