Ransomware operators are increasingly deploying “ransomware killers” that surgically overwrite the memory of security processes instead of simply terminating them, allowing encryption to proceed.
At the same time, endpoint tools appear to run normally but are effectively blind. This evolution marks a shift from crude process-killing to stealthy, in‑memory tampering that targets EDR/AV telemetry, kernel callbacks, and validation routines at runtime.
Traditional ransomware often issues direct process termination calls against antivirus and EDR agents, which can trigger alerts, leave clear forensic traces, or even cause system instability.
Recent campaigns instead abuse vulnerable kernel drivers to gain arbitrary read/write access to physical memory, then selectively overwrite critical structures inside security products while leaving the processes alive.
This approach preserves the outward appearance of protection while silently stripping away detection and response capabilities at the kernel and user‑mode layers.
One prominent example is the Qilin ransomware’s multi‑stage EDR killer, which side‑loads a malicious DLL and ultimately uses abused drivers (such as ThrottleStop variants) to read and write kernel memory.
Rather than mass‑terminating agents, its final stage unregisters EDR callbacks for process, thread, and image events and tampers with validation routines like CiValidateImageHeader, effectively blinding telemetry collection and allowing malicious operations to proceed under the cover of “healthy” security software.
This kind of runtime manipulation is fundamentally different from static file replacement or simple process kills; it is an in‑memory, live‑system sabotage.
These ransomware killers heavily rely on “Bring Your Own Vulnerable Driver” (BYOVD) techniques, repurposing legitimately signed but flawed drivers that expose IOCTLs for arbitrary memory operations.
Once loaded with administrative privileges, the driver interface can be used to enumerate modules, resolve kernel base addresses, and patch sensitive structures or functions in memory.
Research has shown campaigns abusing such drivers to loop through running processes, identify core security components, and either disable or neuter them by altering their internal state and execution paths.
Notably, some implementations restore original bytes after executing their malicious routines, minimizing crashes and complicating forensic analysis.
Ransomware Killers Overwrite Security Process
By dynamically flipping kernel code, these tools can invoke privileged functions such as process termination or callback deregistration then revert the patched code, reducing behavioral fingerprints that defenders typically rely on.
Catalyst Researchers said that, Phantom Mantis operates a mixed-source killer portfolio. The portfolio combines an operator-maintained GentleKiller-related line with third-party and public BYOVD tooling.
The result is a near‑fileless, runtime‑only control channel for dismantling defenses just prior to or during encryption.
The bounded ten-iteration loop and 500-millisecond sleep provide an approximately five-second unload window. The loop is a useful behavioral distinction from G13, which performs only one cleanup attempt.
For defenders, these attacks fall squarely into the category of runtime, in‑memory compromise, where the trust boundary is eroded from inside the operating system’s execution environment rather than via traditional malware binaries.
Endpoint agents that depend on kernel callbacks, memory scanners, or driver‑mediated telemetry can be quietly disconnected without any visible process failure, error messages, or immediate service stoppage.
From an incident response perspective, systems may appear fully protected in dashboards while, in reality, the key enforcement and detection hooks have been overwritten and nullified.
This trend also undermines classic hardening guidance that focuses primarily on process enumeration and termination as indicators of AV tampering.
Because the ransomware killers keep the applications technically “running,” traditional health checks and watchdog mechanisms may not flag an issue until after widespread encryption or data destruction.
The sophistication of techniques like Process Doppelgänging and advanced process injection further complicates logging and attribution, as the malicious code often executes in the context of legitimate modules.
The rise of driver‑based ransomware killers complements broader adoption of process memory injection and hollowing techniques catalogued under the MITRE ATT&CK framework (for example, T1055 variants and /proc memory injection on Linux).
Recent analyses of families like SynAck, BlackMatter and others highlight continuous refinement of in‑memory evasion, including transactional file system abuse, stack overwrites and callback hijacking.
Parallel research on runtime attacks and Trusted Execution Environment bypasses further emphasizes that modern malware increasingly targets what happens inside memory rather than what resides on disk.
Defenders are responding with stricter driver allow‑listing, kernel memory access monitoring, and behavior‑based rules that detect anomalous use of IOCTLs and callback deregistration, alongside hardened policies around vulnerable driver loading.
However, the current wave of ransomware killers demonstrates that attackers are already comfortable operating at this level of sophistication, and that enterprise security strategies must treat arbitrary memory access and in‑kernel tampering as first‑class detection priorities.
$1M Data Breach Warranty is Genuine Protection?: Download 10 Point Free AI SOC Breach Warranty Guide
