The notorious RansomHub ransomware group has recently been observed leveraging a legitimate tool from Kaspersky to circumvent endpoint detection and response (EDR) systems. This strategic maneuver allows them to deploy secondary malware on compromised systems without detection.
Exploiting Kaspersky’s TDSSKiller
Cybersecurity experts at Malwarebytes have identified this alarming trend in the wild. Once RansomHub infiltrates an endpoint, their first course of action is to neutralize any existing EDR solutions. This step is crucial before they can unleash infostealers or encryption malware onto the affected systems.
In this particular instance, the group has turned to TDSSKiller, a specialized tool developed by Kaspersky. Originally designed to detect and eliminate rootkits, especially those belonging to the TDSS family (also referred to as TDL4), TDSSKiller has been repurposed by RansomHub to further their malicious agenda.
This development raises significant concerns within the cybersecurity community, as it highlights the lengths to which cybercriminals will go to exploit legitimate software for nefarious purposes. The implications for businesses and their cybersecurity protocols are profound, necessitating a reevaluation of existing defenses against such sophisticated attacks.
