TA Phone Home: EDR Evasion Testing Reveals Extortion Actor's Toolkit

Unit 42 investigated an extortion incident where a threat actor acquired access via Atera RMM and used a virtual machine to test an AV/EDR bypass tool (disabler.exe) that loads a vulnerable driver (BYOVD). The investigation yielded Cobalt Strike and Mimikatz artifacts, video demos and forum posts linking the tool to a seller called "KernelMode", numerous host and network IOCs, and evidence used to profile and likely identify an individual associated with the rogue VM.