Bring your own vulnerable driver (BYOVD) is having a moment in endpoint security. Some of the buzz is earned. Some of it is overblown. This series unpacks both and shows the evidence for each. This piece weighs the trust gap the technique exploits against what the data actually shows.

A long-revoked certificate still loads a driver into the Windows kernel today. Help Net Security traced a 2026 intrusion to a decade-old forensic driver whose signing certificate had expired and been revoked years earlier. The kernel loaded it anyway.

The reason is structural, and it explains why the defensive target most teams chase is the wrong one. Defenders track bad drivers. We pull the LOLDrivers catalog, sync the default driver blocklist, and watch the list grow. The list is not where attackers compete. They compete over signing trust. A signature is the scarce thing. A driver is just the disposable wrapper around it.

Trust Is the Scarce Resource and Drivers are Disposable

Think about a stolen credit card. The number keeps clearing for hours or days in the gap before merchant blocklists sync. The thief does not need a new card. They need the window where the old one still works. Card networks did not win by perfecting the blocklist. They won by scoring the transaction itself in real time, regardless of whether the number was flagged yet.

Signed drivers run on the same broken model. The blocklist is the merchant blocklist. The signature is the card. Attackers live in the propagation gap, and that gap is wide.

The defensive move that follows is to stop chasing the card numbers and instrument the transaction. This is the reframe no competitor owns. Defend the trust anchor, because the list will always trail it. The anchor is the signing trust itself: revocation, signature metadata, and the slow death of cross-signed-driver trust. A list of bad drivers grows forever. The set of trust mechanisms that let those drivers load is small and addressable.

The web learned this lesson the hard way already. Online Certificate Status Protocol (OCSP) soft-fail meant a browser that could not reach the revocation responder simply trusted the certificate anyway. The kernel driver model carries the same flaw in a harsher setting. There is no soft-fail to debate, because the kernel does not ask the question at all.

The Proof Is In the Certificates

The economics favor the attacker because trust concentrates. Public threat research found a single GitHub PFX file holding more than a dozen expired certificates, drawn from the 2015 Hacking Team leak and Chinese forums. That one file forged signatures on thousands of malicious drivers.

A small set of compromised keys signs an unbounded supply of drivers. A few stolen keys against thousands of drivers means the list defenders maintain can never catch up. Block a driver and the cost is one recompile. Edit unauthenticated bytes, the file hash changes, and the same key signs a new artifact. The blocklist entry you just earned is already stale, because the signing key did not move and the key is the asset. SentinelOne®'s latest Annual Threat Report documents loaders that reintroduce effectively the same payload under fresh hashes to outpace simple hash-based blocking.

The trust-pyramid framing from that research describes a real structure. At the base sit individual drivers, cheap and disposable. Above them sit the end-entity certificates that sign batches of drivers, and at the apex sit the cross-signed certificate authorities the kernel anchors to. An attacker who climbs one level multiplies their reach across everything below it, and defenders who fight at the base are fighting where the attacker has infinite supply.

The same research showed how attackers manufacture fresh trust on demand. Tools forge signature timestamps, exploiting the pre-July-29-2015 cross-signed certificate exception by backdating a signature so it appears to predate the cutoff. An expired or revoked certificate becomes a working signing key again. The forgery does not break the trust chain. It satisfies it.

The kernel makes this worse by refusing to check revocation. Windows loads drivers signed with revoked certificates even when a local revocation list is present, and the decade-old forensic driver case showed the same failure in 2026. The operating system's kernel-mode signing policy accepts end-entity certificates issued before July 29, 2015 if they chain to a cross-signed authority. The policy codifies the loophole rather than closing it.

The defensive consequence follows directly. Blocking expired and revoked certificate driver loads, paired with the blocklist, beats the blocklist alone. The blocklist enumerates known-bad files one at a time. Revocation enforcement attacks the reusable key behind all of them, scaling against the attacker instead of with them.

A certificate authority revokes a key when it learns the key is compromised, and in a working system every consumer checks the revocation list and refuses the key. A revoked certificate carries a clear instruction, do not trust anything this key signs, and the kernel loads the driver anyway. The attacker did not defeat the trust system. They used the part of it that was never enforced.

The Driver Persistence Half-Life

Now the data. Against the LOLDrivers catalog, roughly one-third of catalogued vulnerable driver samples are not covered by the default blocklist. The June 19, 2026 pull puts it at 36 percent. That is 782 of 2,190 samples, absent from the default list. About 22 percent, 479 samples, load even with Hypervisor-Protected Code Integrity (HVCI) enabled.

Call this the Driver Persistence Half-Life, the signature data point of this argument.

Be honest about what that number is. The 36 and 22 percent figures are point estimates from a single computed pull against one blocklist version. The method is published and reproducible: parse the enforced HVCI SiPolicy and the official block rules against the LOLDrivers JSON, match by file hash, then by authenticode metadata, and pin both to a commit and a version.

The caveats matter. The denominator is the LOLDrivers catalog, not every driver that exists. "Not covered" means absent from the default block rules, not exploitable on a given host. Hash coverage is brittle, because an edit to unauthenticated bytes changes the hash without changing the abuse.

The corroboration is real, and it is fewer voices than it looks. The catalog's own coverage metrics report that many LOLDrivers entries sit off the default blocklist, and public threat research corroborates the cadence qualitatively, confirming that systems can be attacked with a driver not yet listed. Two open tools reproduce the check itself, Trail of Bits' HVCI-loldrivers-check and a community block-rules checker, but no genuinely independent second count of the exact figures exists yet.

The lag underneath the number is the real exposure. The default blocklist updates only periodically through Windows Update, roughly once or twice a year, and deliberately holds back some blocks to avoid breaking legitimate software. The minimum disclosure-to-block window is a calendar quarter, and the historical window has run to six months or more. Most of these vulnerable signed drivers are reachable without admin rights, so the exposure is wide and the door is low.

The on-device reality runs worse than the stated cadence. Public reporting documented a Windows 10 driver blocklist frozen at a December 2019 version until an October 2022 fix. That is a roughly three-year gap between the published cadence and what shipped on the machine. A defender reading the cadence would assume quarterly freshness. The endpoint disagreed for three years.

Per case, persistence runs to years. SentinelLABS disclosed Dell's dbutil_2_3.sys flaws in 2021, and the signed-but-vulnerable driver was still disabling security tooling in 2024. SentinelLABS noted that the driver's certificate had not been revoked, leaving it abusable long after disclosure.

The half-life metaphor is precise. The catalog grows faster than the blocklist can absorb it, so the gap widens rather than closes, a long, slow decay that the attacker schedules around.

The method is reproducible against your own fleet. Run the same hash and authenticode match against the drivers that actually load, and the result is a number that describes your real exposure, a measurement you can repeat each quarter. The durable claim stays the honest one: roughly one-third of catalogued vulnerable drivers are not blocked by default. The precise 36 and 22 percent belong to one computed pull, a snapshot with a published method attached.

Blocking Everything Breaks the Business

The obvious fix is to block every old driver. That fix is impractical, and the platform's own documentation says so plainly: the blocklist "isn't guaranteed to block every driver," and blocks are held back precisely to avoid breaking functionality.

Vulnerable drivers are dual-use. Public threat research catalogued how most abused drivers ship as legitimate software components first. The same signed driver that disables an EDR this week was a working hardware utility last week. The blocklist maintainer weighs one confirmed abuse against tens of thousands of working installs. The hold-back is a rational choice under that math, and the exact gap the attacker schedules into.

The reboot gap makes the DIY approach worse. Independent analysis of the blocklist notes that a driver the policy would block keeps running until the next reboot, so an in-progress kill chain survives the moment you activate the policy. The attack surface reduction (ASR) rule that blocks vulnerable signed drivers only stops a driver from being written to disk. It does not block one already present from loading. Defenders who think they have closed the gap have often only narrowed the entry path.

The platform is moving the trust anchor. A Windows security update in April 2026 removes default trust for cross-signed kernel drivers, directly targeting the loophole the timestamp-forgery and pre-2015 exceptions opened. This is the industry bending toward the right target, attacking the reusable signing key itself, which is the correct altitude.

It helps. It does not close the gap. The April change applies to default trust going forward, so the 36 percent that sit off the blocklist today are not retroactively addressed by changing tomorrow's trust rules. The half-life keeps running on the inventory that already exists.

A separate chokepoint also remains in play. Public threat research documented one EDR killer used by multiple ransomware gangs whose coordination point was a shared packer-as-a-service, with no shared driver tying them together. The packer became the chokepoint when the driver did not. That is the pattern to internalize. Each fix narrows one path and exposes the next. Tighten cross-signed trust and the attacker leans harder on forged timestamps. Close the timestamp loophole and they lean on the unsynced backlog. The trust model has many anchors, and the attacker only needs the cheapest one still standing.

This persistence is not an accident of the technique. It is the product of an industry on the other side. SentinelOne's latest Annual Threat Report describes the industrialization of the modern cyber breach, with mature automation accelerating intrusions at scale. A trust gap that one researcher could exploit becomes one that a tooled-up criminal market exploits at volume, which is why the half-life persists across so many drivers at once.

This piece builds on prior work. Independent security research argued that admin-to-kernel is not a serviced security boundary and that blocklists are largely performative. That critique is correct and it stands. The contribution here is a measured persistence half-life, the certificate-concentration evidence behind it, and a trust-anchor reframe detection engineers can act on.

Stop Chasing the List. Instrument the Failure.

The card networks made the stolen number unprofitable by scoring the transaction. Defenders should do the same with signed drivers. Watch the trust event, because the catalog entry arrives too late to matter.

That means instrumenting the load itself. Sysmon Event ID 6 logs every driver load with its hash, signer, signature, and signature status, and any non-Valid status warrants investigation. This telemetry is low-volume and high-value, which makes it cheap to monitor and hard to flood. The Splunk detection content keys on exactly this event, with an explicit note that the alert needs triage rather than blind firing.

Signature-status detection and first-seen anomaly detection catch what blocklist matching misses. Alert on any driver load whose signature status is not Valid, including untrusted root, explicit distrust, and bad or invalid signatures, and on any driver whose hash, signer, or version has never been seen on the host before. Both approaches key on the trust attribute, so the known-bad list never enters the decision and the alert fires whether or not anyone has catalogued the driver yet.

The CodeIntegrity Operational log confirms whether your blocklist policy actually applied. Event ID 3099 confirms the policy is loaded, a blocked load logs Event ID 3077, an audited load logs Event ID 3076, and Event ID 3089 carries the signature detail. Pairing the block events with the audit events proves which drivers the policy stopped, which turns coverage from an assumption into a measurement. Given the three-year staleness the frozen-blocklist case showed, that proof is not optional.

The behavioral chain is observable end to end. A service is created via sc.exe, logged as Sysmon Event ID 1, and a System Event 7045 fires for the service install. A driver loads under Event ID 6, then a device control call (IOCTL) drives termination against protected processes. Public threat research watched one such loop run a repeating, fixed-interval termination cycle in kernel mode, stepping past protected-process defenses (PPL), and recent killers also unregister EDR kernel callbacks as a distinct observable before terminating processes. Picus mapped the same sequence across cases. Each step is a tripwire on the trust event, and none of it depends on prior knowledge of the specific driver.

The order of the chain is what makes it durable. The driver name changes every campaign, but the structure does not. SentinelOne's latest Annual Threat Report makes the same point about the kernel: activity at that layer can blind user-space instrumentation and leave a manual disk scan an unreliable assurance of cleanliness. Detection keyed to that shape survives a recompile, and detection keyed to a hash does not.

The mental shift is the point. A driver list is a finite answer to an infinite problem, and the trust anchor is small, addressable, and already moving. SentinelLABS research has lived at that anchor for years. The team co-discovered the POORTRY and STONESTOP WHQL-signed toolkit that drove the security advisory ADV220005, and proposed Authenticode-metadata blocklisting before that was standard practice.

Defenders are not behind because the list is incomplete. They are behind because they were grading the wrong exam. Score the trust event, and the half-life stops being the attacker's advantage.

Why This Is the Work SentinelOne Exists To Do

Scoring the trust event instead of chasing the list is the whole argument, and it is the argument SentinelOne was built to win. The platform watches the load itself, the untrusted signature, the first-seen driver, and the masquerading kernel service, from a vantage designed to keep reporting when the kernel turns hostile. Purple AI® carries that telemetry forward. Its Agentic Investigation capability reasons over the trust event the moment it fires, builds the timeline, and renders a verdict in minutes and seconds rather than hours and days. The propagation gap the attacker lives inside narrows when the verdict arrives at machine speed.

A control you have not confirmed is running is a control you are only hoping for, and most teams cannot staff that verification around the clock. Wayfinder, SentinelOne's managed detection and response practice, holds the line when your own team is asleep, fusing human threat hunting with the platform's autonomous investigation and Google threat intelligence. That is the reason the company exists. The trust anchor is small and addressable, and the advantage goes to the defender who instruments it.

Next in this series: The practical hunts themselves, the four distinct techniques hiding inside the phrase EDR killer, and the telemetry that catches each one.

External References

1. EDR killer abuses a vulnerable forensic driver, Help Net Security. February 5, 2026.
2. LOLDrivers security metrics. loldrivers.io (MagicSword), Pull cited as June 19, 2026.
3. HVCI-loldrivers-check, Trail of Bits (GitHub: trailofbits/HVCI-loldrivers-check).
4. loldrivers-database, Community project (GitHub: didntchooseaname/loldrivers-database).
5. New EDR killer tool used by eight different ransomware groups, BleepingComputer. August 6, 2025.
6. EDR Killer Threat Advisory (AD-2025-018), Cyber Security Agency of Singapore. 2025.
7. Sysmon driver-loading (Event ID 6), TrustedSec Sysmon Community Guide.
8. Windows Vulnerable Driver Loaded, Splunk Security Content. 2026.
9. Windows Drivers Loaded by Signature, Splunk Security Content. 2026.
10. Qilin EDR Killer infection chain, SOC Prime. April 7, 2026.

IP Disclaimer:

This blog may include discussion of unreleased services or features. Any unreleased services or features referenced here are still in development and subject to change. Customers should make their purchase decisions based upon features that are currently available.

Bring your own vulnerable driver (BYOVD) is having a moment in endpoint security. Some of the buzz is earned. Some of it is overblown. This series unpacks both and shows the evidence for each. This piece traces how the technique scaled into an industry.

Ransomware actors successfully disabled security tools in about 48% of intrusions in 2024. That figure comes from security researchers, drawn from incident-response engagements across the year. Attackers attempted to blind the defender in most of those cases. They almost always succeeded. Turning off the sensor was once a flourish. It is now a default move.

That 48% is the broad rate for disabling security tools by any method. BYOVD is the kernel-level technique this series tracks, one fast-growing method inside that number, and public threat research treats it as the part of the tamper problem accelerating fastest. Treat the 48% as the ceiling and the BYOVD slice as the piece that scaled into a market.

The Claim: This Became a Supply Chain

EDR killing industrialized over the last several years. SentinelOne®'s latest Annual Threat Report, "Defending Against the Industrialization of the Modern Cyber Breach," names that shift directly, with mature automation accelerating intrusions and tradecraft moving from one-off effort to maintained capability. A killer was once a binary an intruder wrote and discarded. Today it is a serviced capability, built, versioned, and bundled into ransomware-as-a-service for affiliates who never touch a debugger. The defender once faced a hobbyist. Now the defender faces a development pipeline.

A pipeline behaves differently from a one-off binary. It ships versions, fixes bugs, and reuses code across releases. The defender reads that cadence like a vendor roadmap, and every release leaves the same observable footprint when it runs. The reuse is visible in the architecture. Public threat reporting describes one current framework spinning eight-plus variants off a single shared design. That also means a detection tuned to one variant often catches its siblings. Code reuse cuts both ways, and the defender holds one of the edges.

The Proof: A Four-Year Timeline

Start at the floor. Public threat research documented an early Process Explorer-driver killer in 2023, used to disable EDR ahead of Medusa Locker and LockBit. The same year, SentinelLABS tracked an actor called "Spyboy" selling the Terminator killer. The price ran from $300 for a single AV bypass to $3,000 for the all-in-one EDR killer, and the tool abused Zemana drivers. These were early-window artifacts. They were standalone, sold, and disposable.

That timeline has a SentinelLABS anchor that reframes the whole story. SentinelLABS attributed the AvNeutralizer killer, also known as AuKill, to the FIN7 cybercrime group. FIN7 sold it on Russian-language forums at prices running from $4,000 to $15,000. The tool abused a Time Travel Debugging driver and the Process Explorer driver to disable defenses. This is the moment a killer stopped being a one-off and became a product with a price list.

The adoption pattern proves the product framing. SentinelLABS tracked AvNeutralizer spreading into Black Basta, AvosLocker, MedusaLocker, BlackCat, Trigona, and LockBit operations. One group built it, and six competing crews ran it. A single tool crossing that many rivals is the signature of a supplier, and the new feature was distribution.

Then the model changed inside ransomware-as-a-service. In August 2024, public reporting disclosed EDRKillShifter, abusing the RentDrv2 and ThreatFireMonitor drivers and first seen in a RansomHub attack. Researchers assessed with moderate confidence that the tool served multiple attackers, not RansomHub alone. The SentinelOne RansomHub anthology records the affiliate logic behind that spread, a customized EDR-killer tool made available to higher-level affiliates. One crew's tool became many crews' tool, and the new feature was tiered access.

The driver roster widened fast across 2025. In early 2025, public threat research documented a malicious driver that carried stolen, revoked certificates and imitated a legitimate EDR driver to silence defenses inside Medusa intrusions. By August 2025, GuidePoint tracked Akira affiliates in SonicWall VPN intrusions chaining a ThrottleStop driver, rwdrv.sys, with a malicious helper, hlpdrv.sys, to disable the built-in Windows antivirus. Different crews, different drivers, the same kernel-level objective. SentinelOne's latest Annual Threat Report records the same pattern from the other side of the kill, naming crews that script the built-in Windows antivirus into silence and kernel-mode drivers derived from POORTRY used to terminate EDR processes and delete security files.

The CVE-anchored cases arrived next. In December 2025, security researchers documented DeadLock ransomware abusing the Baidu antivirus driver BdApiUtil, tracked as CVE-2024-51324, to terminate EDR and the built-in Windows antivirus. In February 2026, public reporting documented Reynolds ransomware embedding the vulnerable NSecsoft driver NSecKrnl, tracked as CVE-2025-68947, which terminated more than 30 security processes. Those CVE records do not name the ransomware, and the actor mapping comes from threat intel. The same NSecKrnl driver shows up across unrelated crews, tied to Reynolds and to Warlock. A driver is shared infrastructure, so pivoting on the driver hash groups campaigns by supplier, not by gang.

By 2025 the sharing went structural. Threat-intel reporting found one EDR killer used across several competing ransomware families, distributed as distinct per-attack packed builds, and Singapore's national cyber agency corroborated the same multi-group pattern in an August 2025 advisory, independent of any single vendor. Public threat research also catalogued a forming marketplace of named killers priced from hundreds to thousands of dollars. Rivals were now buying from a common counter.

The 2026 picture is operator-run kits with large affiliate cuts. Public threat reporting documented the Gentlemen RaaS shipping its in-house EDR killer framework, running eight-plus BYOVD variants and targeting over 400 processes across 48 security products through DeviceIoControl calls. The operator reportedly hands affiliates around a 90% revenue share, a 10% operator cut against a 20% industry standard, and bundles third-party killers like HexKiller and ThrottleBlood. By April 2026, researchers saw Qilin and Warlock at the same game, Qilin chaining the rwdrv.sys and hlpdrv.sys pair while Warlock ran NSecKrnl. Public threat research now reads EDR killers as a standard, repeatable phase of the attack playbook. SentinelOne's latest Annual Threat Report measured how far the response window has collapsed, with one chained sequence reaching SYSTEM in roughly 30 milliseconds and a separate intrusion moving from initial download to a persistent service in 49 seconds.

The Turn: Acceleration Over Origination

Here is the correction the timeline forces. Commercial sale of EDR killers predates the 2024 window. SentinelLABS had Terminator on the market in 2023 and dated FIN7's AvNeutralizer sales earlier still. ExtraHop tracked a dark-web market for these tools across 2024 and 2025. Older still, the open-source EDRSandblast project weaponized a vulnerable driver against more than 1,000 security drivers back in 2022. The raw capability was for sale before the surge.

So the real story is acceleration and consolidation. The non-obvious shift is that rival ransomware crews stopped competing on this layer and started sharing it instead. Several groups feeding from one killer is a market choosing a common supplier. The cost of building beats the cost of buying.

The economics pulled the skill floor down. Reynolds ransomware bundled a vulnerable driver as a recruiting selling point aimed at less-skilled operators, and a capability that once required a kernel developer now requires a subscription. The driver is the part most likely to fail in unskilled hands, so researchers documented a practice they call driver decoupling. Affiliates install the vulnerable driver and confirm it loads before running the killer. That is the kind of guardrail a supplier adds to keep low-skill customers successful, packaging doing the work the operator used to do by hand.

What Makes Consolidation Possible

Markets need shared infrastructure, and this one has it. The shared killer that reporting tracked was one tool reissued as distinct packed builds for each attack, with the packer as the common chokepoint several rivals fed through. Singapore's advisory described the same customized-build distribution model, a single supplier serving many buyers.

The driver supply explains why it scales. Public reference lists now track thousands of vulnerable signed drivers, most reachable without admin rights. The live LOLDrivers catalogue alone records hundreds of unique drivers, a large share still missing from the default driver blocklist. That inventory reads as a parts catalog for the kit builder, a dual-use commodity supply where weak driver access controls hand unprivileged users a way in.

The price ladder runs from the low hundreds for Terminator to five figures for FIN7's AvNeutralizer, both tracked by SentinelLABS, while EDRKillShifter spread through tiered affiliate access rather than a flat price. The skill floor drops in step. EDRSandblast showed the open-source baseline back in 2022, already capable against more than 1,000 security drivers, and a buyer in 2026 does not need that depth. The operator maintains the tool and the affiliate just runs it, so each layer of packaging removes a reason an attacker would have failed. A working tool spreads fast once the price of entry drops to a download.

The Payoff: A Top-Tier Threat Getting Cheaper

Put the pieces together and the threat ranking is clear. Disabling defense is attempted in most ransomware intrusions and succeeds in roughly half. The tooling that does it is now maintained, shared across rivals, and sold with affiliate economics that reward volume. Each force lowers cost and widens reach at once. This is a structural threat, and it is getting cheaper to run.

Defenders set the response, and the response is not despair. Public threat research shows BYOVD remains the dominant kill method, and that dominance means the kill chain stays observable. The killer still has to act in a fixed sequence. It installs a driver, registers a kernel service, and issues the calls that terminate the sensor. Those steps leave telemetry behind them.

The defender should still hold the technique apart from its cousins. BYOVD is one entry in a tamper taxonomy. A driverless class is smaller but growing, and it skips the driver-install step entirely. EDR-Freeze suspends the sensor through a Windows error-reporting race, staying fully in user mode. EDRSilencer uses Windows filtering rules to block the sensor's telemetry from leaving the host. Those two break the driver-load observable, so a detection built only around driver loads will miss them.

Prevention narrows the window without closing it, which is exactly why behavioral observables carry weight. The sequence is concrete enough to map to event IDs. Picus Security described the early steps of the BYOVD chain as logged events. A service created with sc.exe surfaces as a Sysmon process-create record (Event ID 1) and a System service-install event (Event ID 7045). The driver load surfaces as a Sysmon driver-load record (Event ID 6). The killer then issues its DeviceIoControl call, followed by callback removal and security-process termination. Each arrow in that chain is a place to correlate and alert.

The behavior inside that chain is even more specific. Public threat research documented a kill loop where a masquerading kernel service enumerates running processes on a repeating, fixed-interval cycle. It passes the process IDs through an IOCTL so the driver calls the kernel termination routine directly, bypassing the protected-process protections that guard the sensor. The repeating rekill cadence is itself a signal, because a normal service does not poll the process list and terminate from kernel mode on a loop.

Callback removal deserves its own hunt, separate from the kill. SOC Prime documented Qilin loading rwdrv.sys for raw memory read and write, then loading hlpdrv.sys to remove the EDR's registered kernel callbacks across more than 300 products. Stripping callbacks blinds the sensor without terminating its process. The process still runs and still reports healthy. The defender who only watches for a killed process misses this entirely.

The masquerade is its own tell. Frameworks ship variants that each impersonate a legitimate product to blend into a normal driver inventory, and one documented driver carried stolen, revoked certificates to imitate a real EDR driver. The defender's answer is to treat the signer and the first-seen status as data. Splunk detection content keys on any driver load whose signature status is not Valid. Alert on a driver whose hash, signer, or version has never appeared on the host before.

The witnesses also outlast the endpoint. Once the sensor is silenced, network, identity, and cloud telemetry are what remain, and independent analysis found EDR-killer execution preceding ransomware across multiple gangs, a window enough to intervene before encryption. Singapore's national cyber agency framed EDR-killer activity as huntable through driver-load monitoring, termination patterns, and telemetry cessation. An agent's health drop, a lost heartbeat, or a gap in a constant feed all read as tamper, so alert on the absence of expected signal. A high-fidelity variant is System Event ID 7031, the service-crash log Windows writes when a kill abruptly terminates a security service. It is rare in a healthy environment, which makes it a strong candidate for a tight, low-false-positive alert.

The mental shift for the practitioner is this. Stop modeling the EDR killer as an exotic, once-a-year event and start modeling it as supply. A supplied capability has a pipeline, a release cadence, and paying customers, and every one of those is a place to detect, disrupt, and raise cost. SentinelOne builds for that fight. SentinelLABS co-discovered the POORTRY and STONESTOP signed-driver toolkit and drove the security advisory ADV220005 that followed. SentinelOne then shipped Local Upgrade Authorization on by default for new customers to blunt the tamper bypass. The purpose behind that work is to give the advantage to those who secure our future. The industry built a market for killing your sensor. The defender's job is to make that market expensive.

Why This Is The Work SentinelOne Exists To Do

Read the timeline and the conclusion is plain. You do not out-hustle a development pipeline with manual triage. You answer it with a pipeline of your own. SentinelOne built the Singularity™ Platform on Autonomous Security Intelligence (ASI) for this exact asymmetry, so the response runs at the speed the supply chain ships. Purple AI® is the reasoning interface for that platform, and its Agentic Investigation capability launches the moment a threat crosses the line, detecting, investigating, verifying, and responding without waiting for an analyst to wake up. The capability does not displace the human. Wayfinder, SentinelOne's 24/7 managed detection and response practice, puts seasoned threat hunters on top of that autonomous layer, with managed response and an incident-readiness retainer when the worst happens. The killer industrialized. The defense industrialized with it.

Next in this series: the trust gap underneath every one of these drivers, and why a certificate revoked sixteen years ago still loads code into the Windows kernel today.

External References

1. "EDR killers are now a thing, and ransomware crews love them," The Register, 14 August 2025.
2. "RansomHub gang deploys new tool to kill EDR software," Security Affairs, August 2024.
3. "GRIT Report: Akira and SonicWall," GuidePoint Security, 5 August 2025.
4. "Event ID 7031: Service crash," ManageEngine EventLog knowledge base.
5. "CVE-2024-51324," National Vulnerability Database.
6. "Reynolds ransomware uses BYOVD to disable security before encryption," Security Affairs.
7. "CVE-2025-68947," National Vulnerability Database.
8. "Advisory AD-2025-018," Cyber Security Agency of Singapore, 16 August 2025.
9. "The Gentlemen RaaS uses GentleKiller," The Hacker News, June 2026.
10. "Inside GentleKiller: the EDR killer powering the Gentlemen," Security Affairs.
11. "Gentlemen Ransomware Gang Standardizes EDR Killing," BankInfoSecurity.
12. "The Dark Web Market for EDR Killers," ExtraHop, 2024.
13. "EDRSandblast," Wavestone CDT, GitHub.
14. "EDRSilencer," netero1010, GitHub.
15. "EDRSilencer red team tool used in attacks to bypass security," BleepingComputer, 15 October 2024.
16. "New EDR-Freeze tool uses Windows WER to suspend security software," BleepingComputer, 22 September 2025.
17. "What Are Bring Your Own Vulnerable Driver (BYOVD) Attacks," Picus Security, 2026.
18. "Qilin EDR killer infection chain," SOC Prime, 7 April 2026.
19. "Windows Drivers Loaded by Signature," Splunk research.
20. "Windows Vulnerable Driver Loaded," Splunk research.
21. "loldrivers.io," live vulnerable-driver reference list, accessed 26 June 2026.

IP Disclaimer:

This blog may include discussion of unreleased services or features. Any unreleased services or features referenced here are still in development and subject to change. Customers should make their purchase decisions based upon features that are currently available.

Bring your own vulnerable driver (BYOVD) is having a moment in endpoint security. Some of the buzz is earned. Some of it is overblown. This series unpacks both and shows the evidence for each. This piece looks at the market that grew up around the technique.

A ransomware crew now ships an in-house “EDR killer” to its affiliates the way a product team ships software. It maintains the codebase. It versions the variants. It hands the tooling to paying partners with a support model behind it. The kill is no longer an improvised step in an intrusion. It is a product, and someone is on call for it.

That shift matters because it changes who you are actually fighting. Defenders have spent years treating the EDR killer as a lone operator's trick. The picture was a one-off binary, smuggled in by whoever read the right blog post. The current evidence points somewhere harder. EDR killing has become a service economy with pricing, affiliates, and operator-led R&D.

The clearest case is a ransomware-as-a-service (RaaS) operation tracked under the operator alias "hastalamuerte". Public threat reporting describes a crew that emerged in late 2025. It reached the top five ransomware gangs by the first quarter of 2026. Its flagship is an EDR killer framework that researchers describe as a shared development template. The operators build it. The affiliates use it.

Look at the build, and the word “framework” is earned. Researchers tracking the crew count eight or more variants in the kit. Each variant maps to a specific vulnerable driver, including ones from NSecsoft, Zemana, Qihoo 360, and Safetica. Each impersonates a legitimate security product to blend in. Together the variants hunt more than 400 processes across roughly 48 security products. They abuse kernel access to terminate the agents that should be watching.

The impersonation detail is the tell. Investigators found that each variant dresses up as a different legitimate security product, matching the driver it abuses. That is a product decision, made so the kill survives longer on more configurations. A lone operator does not build for portability across 48 defenders. A supplier with paying customers does, because portability is what the customers are buying.

The driver coverage reads like a compatibility matrix. The same reporting maps individual variants to drivers from NSecsoft, Zemana, Qihoo 360, and Safetica. Each loads through standard kernel control calls. A vendor supports many file formats so the product works on more customer machines. This crew supports many drivers so the kill works against more deployed defenders. The engineering intent is the same. Maximize the install base the tool can operate on.

This is a product line with coverage targets. The same crew also ships third-party killers alongside its own. Public reporting names HexKiller, ThrottleBlood, and HavocKiller carried in the same suite. It bundles a credential stealer called OxideHarvest as well. The kit is curated like a catalog.

A Catalog with Prices

Step back from one crew and the market comes into focus. Public threat research catalogs a large and growing population of EDR killers in circulation. That is not a handful of clever binaries. It is an inventory, large enough to support specialization, resale, and competition between sellers.

The scale sits underneath, in the drivers these tools abuse. Public threat research catalogs thousands of vulnerable signed drivers, most reachable without admin rights. A live tracking project keeps the running count of these drivers public. Cisco Talos found a single Qilin-linked killer that targets over 300 different EDR drivers in one tool. The raw material for this market is enormous, and most of it loads without elevated access.

Several of those tools carry price tags. SentinelLABS documented the Terminator EDR killer in 2023, sold by an actor known as Spyboy. The tool went for $300 to $3,000 and abused Zemana drivers. Priced tooling has a longer history here than most defenders assume. The kill has had a list price for years. What changed is the size of the shelf.

The strongest evidence sits in a SentinelLABS investigation of FIN7. The crew built an EDR killer called AvNeutralizer, also known as AuKill. It abused TTD and Process Explorer drivers to neutralize protected processes. FIN7 then sold it on Russian forums for $4,000 to $15,000. The same tool was adopted by Black Basta, AvosLocker, MedusaLocker, BlackCat, Trigona, and LockBit.

That resale pattern is the whole thesis in one artifact. One crew built the capability, then rented it out to many competing gangs. SentinelLABS traced AvNeutralizer from a single author into the toolkits of half a dozen rival operations. The kill became a commodity input the moment it had a price and a buyer. EDR killing turned into an industry the same way anything does. Someone built it well, and the rest of the market bought rather than rebuilt.

Once a tool has a price, it behaves like any other piece of software for sale. Listings imply buyers. Buyers imply reviews, resale, and pressure to ship the next version. A market does to evasion tooling what it does to everything else. It improves the product on a demand curve you do not control.

Look at the price ladder and the segmentation becomes obvious. A $300 entry point and a $3,000 ceiling on the Terminator tool is not a flat fee. It is tiered pricing, the kind a vendor sets when buyers differ in budget and need. The $4,000 to $15,000 spread on AvNeutralizer sits a tier above it. Cheap tools for low-stakes jobs, premium builds for hardened targets. Pricing tiers are a sign of a market that has matured past one seller and one product.

The naming convention carries its own signal. Sellers brand and version their killers, from Terminator to AvNeutralizer to EDRKillShifter. You do not name and version a tool you intend to use once. You name it because buyers will ask for it again, recommend it, and compare it to the competition. The naming convention is a small detail. It tells you the supply side expects repeat business.

A Market with Many Hands

The economics of the Gentlemen operation tell the rest of the story. Public reporting describes the crew handing affiliates reportedly around 90% of ransom proceeds, with centralized provisioning of the tooling. One outlet framed it as a 10% operator cut against a roughly 20% industry standard. Read that as a vendor incentive. The operators take a small margin and bet on volume, because the platform is where their advantage lives.

That split is the load-bearing number, so it deserves a careful read. A roughly 90% affiliate share is unusually generous for ransomware-as-a-service. The operator is choosing reach over margin per job. You give away most of the take when you expect a very large number of jobs. The economics describe a platform play, sized for scale rather than for any one payout.

The effect is plain once you size it. Centralized provisioning plus a reported 90% share puts kernel-level EDR evasion in the hands of low-skill affiliates. These are people who could never write it themselves. The operator carries the kernel risk. The affiliate carries the ransom note. The suite moves between them on a provisioning channel.

That division of labor is the heart of the business model. Kernel-level evasion is the hardest part of a modern intrusion to build correctly. Concentrating it in one operator and renting it out turns a rare skill into a commodity input. Every affiliate who pays gets a capability that used to gate entry to the trade. The skill floor drops to the price of admission.

Size the model and the logic gets sharper. In conventional ransomware-as-a-service, operators keep a meaningful slice, often around a fifth, to fund development and infrastructure. The Gentlemen operator keeps about a tenth. An operator gives up that much margin for one reason. The affiliate base is large enough that a thin slice still funds the shop. The revenue share is a window into scale the crew otherwise hides.

The provisioning channel reinforces the read. Threat reporting describes the suite as operator-maintained and centrally delivered, not handed over once and forgotten. That is a recurring-service relationship, the kind that throws off recurring revenue. The operator updates the tooling. The affiliate keeps coming back to the same channel. A one-time sale does not behave like that.

I want to be careful here. The rich affiliate split is a strong indicator of how fast this scaled. Calling it a proven cause would overstate the evidence. The honest read is that the economics and the surge move together. The economics make the surge cheap to sustain.

The Supply Chain Underneath the Brand

The same pattern shows up well beyond one crew. SentinelLABS traced AvNeutralizer from FIN7 into Black Basta, AvosLocker, MedusaLocker, BlackCat, Trigona, and LockBit. That is cross-crew reuse at the operator and affiliate level. It happens when the tool is a product an actor buys and carries from job to job.

A secret a single gang hoards does not spread that way. A purchased product does. The AvNeutralizer pattern is the clearest market signal in the whole dataset. One seller, many competing buyers, the same evasion capability flowing to all of them through the actors who pay for it.

The consolidation is not unique to one tool either. Public reporting documented EDRKillShifter, built and maintained by the RansomHub operation. SentinelOne®'s anthology on RansomHub describes a customized EDR killer made available to higher-level members, a tiered affiliate access model. The capability sat behind a membership tier, the way a vendor gates premium features. Higher-paying partners got the better tool.

Operator-built tooling travels under its own banner. The same EDRKillShifter code, first disclosed abusing the RentDrv2 and ThreatFireMonitor drivers, surfaced across multiple ransom-note brands. Whether the tool is rented, bought, or shared, the direction is identical. Evasion has a supplier tier, and it serves more than one storefront.

Notice what survives across these examples. RansomHub-built code outlived its association with any one affiliate. AvNeutralizer kept appearing because buyers across crews kept needing it. The constant in every case is the capability, not the crew. Defenders who chase the crew chase the part of the system that is designed to be replaceable.

This is the non-obvious part. Rival ransomware crews are not real rivals at the layer that hurts defenders. They draw from a shared supplier base for evasion, the way competing retailers buy from the same wholesaler. The brand on the ransom note changes. The thing that turns off your sensor often does not. A defender who maps these crews as separate threats misreads the board.

The market signal in cross-gang reuse is worth naming directly. The same evasion capability appears under many different ransom brands. That tells you the supplier tier consolidated faster than the affiliate tier. A defender watching ransom-note attribution sees diversity. A defender watching the kill technique sees concentration. That concentration is where a defender gains the most ground against the whole market.

What a Market Does that a Binary Does Not

A market scales. That is the entire point of building one. It is why this beats any single piece of malware on reach. A lone operator's tool dies with the operator's attention. A maintained kit with paying affiliates gets patched, re-versioned, and pushed to people who never have to understand it. The variant count, eight and growing, is the signature of a roadmap under active development. SentinelOne's latest Annual Threat Report describes the same machine multiplier across the landscape. Mature automation accelerates intrusions and compresses the window defenders have to respond.

A market also lowers the skill floor. The affiliate buying into a reported 90% split does not need kernel internals. The operator handles that. So the population capable of silencing an enterprise EDR is no longer bounded by who can write kernel exploits. It is bounded by who can pay. That is a far larger group.

A market hardens, too. When a supplier reuses tooling across crews, a takedown of one customer leaves the supplier intact. The detection a defender ships against one campaign may not survive the next build from the same shop. You are facing a software vendor's release cadence. The target moves on a schedule you do not set.

The corroboration runs across many independent shops, which matters for a claim this load-bearing. SentinelLABS documented FIN7's AvNeutralizer spreading across six named gangs. Public reporting traced EDRKillShifter under the RansomHub banner and beyond. SecurityWeek described a successful EDR killer drawing fast interest across the affiliate community as a favored asset. A CVE record (CVE-2025-68947) describes a separate ransomware family bundling a vulnerable NSecsoft driver to terminate more than 30 security processes, a capability that reads as a recruiting selling point. Different families, different reports, one direction. The kill is being marketed and sold.

Defend the Supply Chain That Feeds the Kill

So plan against the industry. The artifact is downstream of it. The instinct to hunt the specific binary, the named driver, the published hash, is what this market defeats. The published indicators, the sample filenames and the mapped techniques, are a snapshot of one release. Treating them as the whole problem is how you stay one version behind.

The durable move is to defend the behavior and the trust relationships the whole market depends on. Every variant in that kit, whatever its name this quarter, has to do the same two things. It loads a driver it does not own. It reaches kernel space to terminate a protected process. That chain is the constant. The supplier can re-skin the binary. The supplier cannot easily re-invent the move.

This is where an AI-native posture earns its place. Detection built into the kernel and reasoned over behavior watches the move itself, past whatever manifest the binary presents. It is built in, not bolted on. The Singularity™ Platform runs on Autonomous Security Intelligence (ASI) for exactly this reason. ASI pairs agentic workflows with human-level reasoning to catch the move itself, whatever manifest the binary presents.

That design watches the behavioral chain itself. Researchers have observed the kill-loop in the open. A masquerading kernel service enumerates processes in a repeating, fixed-interval termination loop. It sends PIDs through an IOCTL so the driver calls a kernel-mode termination routine, bypassing protected-process defenses. Some variants also unregister the EDR's kernel callbacks, a distinct observable that public research has tracked across more than 300 products. A design anchored to that observed chain survives when the indicators rotate and the seller ships a fresh build.

The repeating re-kill loop is itself a defensive opportunity. A tool that hammers a process list on a fixed interval leaves a rhythm in the telemetry that a single hash never reveals. The driver name will change with the next release. The killer still loads an unowned driver and reaches into kernel space to terminate protected processes. That move is the part the supplier cannot cheaply redesign. Watch it and the catalog churn underneath stops mattering as much.

Walk out of this with one frame changed. The EDR killer is a maturing software industry with operators, affiliates, suppliers, and customers. Defenders are the protagonists in that story. The work is to give the advantage to those who secure our future. Plan against the market that funds the kill. The binary that delivered it is only the receipt.

Why This is the Work SentinelOne Exists to Do

The kill is a product now, maintained and resold. The defense cannot be a static signature that ages out with the next build. The Singularity Platform watches the behavioral chain the supplier cannot cheaply redesign. It watches the unowned driver loading and the reach into kernel space to terminate a protected process. Purple AI®, the agentic security analyst at the center of the platform, turns that signal into action. Its Agentic Investigation capability runs zero-click investigations that detect and , verify, and respond on their own, compressing work that once took hours into minutes. When a kit re-skins itself overnight, the platform reasons over what the kit still has to do.

No team watches the console at three in the morning, the hour this market was built to exploit. Wayfinder, SentinelOne's managed detection and response practice, keeps that watch for you. It pairs human threat hunters with the same autonomous investigation and threat intelligence behind the scenes. That is why the company exists. The advantage belongs to the defender, and the platform is built to keep it there even as the supplier ships its next version.

Next in this series: how the kill went from a hobbyist's trick to a maintained industry, traced across a multi-year timeline.

References

1. "The Gentlemen RaaS Uses GentleKiller to Disable EDR Defenses," The Hacker News, June 2026.

2. "GentleKiller: Gentlemen ransomware builds an EDR killer framework," Infosecurity Magazine, 22 June 2026.

3. "Inside GentleKiller: the EDR killer powering the Gentlemen," Security Affairs, June 2026.

4. "Gentlemen Ransomware Gang Standardizes EDR Killing," BankInfoSecurity, June 2026.

5. "RansomHub," SentinelOne Anthology.

6. "Gentlemen ransomware uses multiple EDR killers to disable defenses," BleepingComputer, June 2026.

7. "Exploring Vulnerable Windows Drivers," Cisco Talos, 19 December 2024.

8. "LOLDrivers: Living Off The Land Drivers," Accessed June 2026.

9. "Qilin ransomware's EDR killer," Cisco Talos, 2 April 2026.

10. "Terminator EDR Killer (Spyboy): Detecting and Preventing a Windows BYOVD Attack," SentinelOne (SentinelLABS), updated 27 April 2025.

11. "FIN7 Reboot: Cybercrime Gang Enhances Ops with New EDR Bypasses and Automated Attacks." Antonio Cocomazzi, SentinelLABS, 17 July 2024.

12. "Ransomware crews flaunt their EDR-killer wares." The Register, 14 August 2025.

    1. "RansomHub ransomware uses a tool to kill EDR software." Security Affairs.

13. "Annual Threat Report: Defending Against the Industrialization of the Modern Cyber Breach." SentinelOne.

14. "Ransomware Groups Increasingly Adopting EDR Killer Tools." SecurityWeek.

15. "CVE-2025-68947." National Vulnerability Database (NVD).

    1. "Reynolds ransomware uses BYOVD to disable security before encryption." Security Affairs.

16. "Qilin EDR Killer infection chain." SOC Prime, 7 April 2026.

    1. "What Are Bring Your Own Vulnerable Driver (BYOVD) Attacks?" Picus Security.

Third Party Disclaimer:

All third-party product names, logos, and brands mentioned in this publication are the property of their respective owners and are for identification purposes only. Use of these names, logos, and brands does not imply affiliation, endorsement, sponsorship, or association with the third-party.