Terminator EDR Killer (Spyboy) | Detecting and Preventing a Windows BYOVD Attack
A Russian-speaking hacker has been making headlines recently after promoting a tool that the threat actor claims can bypass EDR
A Russian-speaking hacker has been making headlines recently after promoting a tool that the threat actor claims can bypass EDR and AV tools. The so-called ‘Terminator’ tool is said to be able to kill processes belonging to “all AVs/EDRs/XDRs”, which if used in conjunction with other malware, could allow threat actors to breach defenses. SentinelOne customers are protected from the Terminator EDR tool.
In this post, we take a look at how the tool works and how organizations can stay protected from it.
What is Terminator EDR Killer?
Late last month, a threat actor using the pseudonym “Spyboy” began promoting a malicious tool for sale on a Russian hacking platform, offering the tool for sale at prices ranging between $300 for a specific AV bypass and $3000 for a so-called “all-in-one” EDR killer.
The threat actor’s videos demonstrating the tools on Sophos and CrowdStrike solutions were widely shared across social media, raising concerns among enterprise security teams that their organizations were at risk.
How the Terminator Tool Works
Terminator utilizes the Bring Your Own Vulnerable Driver (BYOVD) attack technique, which involves threat actors deploying drivers that are legitimately signed and can be successfully loaded into Windows systems.
However, these drivers have vulnerabilities that grant attackers the ability to execute attacker-provided code in kernel context. This puts the attackers in a privileged position, enabling them to circumvent the limitations imposed by the operating system on user processes. The consistent use of the BYOVD technique by threat actors has been observed over the past several years, leading to heightened awareness within the information security community regarding its existence and implications.
Terminator uses the BYOVD technique by deploying and loading vulnerable versions of Zemana anti-malware kernel drivers. This enables the execution of attacker-provided malicious code in kernel mode, thereby granting attackers the capability to terminate any system or user processes, including those associated with detection mechanisms.
SentinelOne Customers Protected
The SentinelOne Agent detects the execution of known Terminator samples, and we continue to monitor this malware family closely.
Organizations not protected by SentinelOne are advised to review the indicators of compromise below.
Indicators of Compromise
SHA116d7ecf09fc98798a6170e4cef2745e0bee3f5c73b8ddf860861cc4040dea2d2d09f80582547d105628e63caf72c29042e162f5f7570105d2108e3c28dd52bfea92cbd91a042939a9cad69fdb666dfa38f4b79b8026da7f966d38a8ba494c113c5e3894ba3d612a5ea3439ba72157bd96e390070bdddbbf3a42018caa7243c54ecec35982790d96f38af90eaadc5510dd775a4e846aba9fde84b5984d33768b4b99a5396094b6b20cea72fbf0c0083030155f74ec0d19461eb48b2bb66c0d2835370f491b35d24d2c83075a691401c015566eff8b0d06c42410a9cbbce42d6114fef0a42aee5866c68d0a31170bb8fa7db361424c040833576f1d7b3ee65005de0118227dd4cd182192b43d4105786ba87f55a036ec45ef2
