{"id":9017,"date":"2025-12-08T10:04:29","date_gmt":"2025-12-08T10:04:29","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/12\/08\/shanya-edr-killer-leveraged-by-ransomware-groups-to-clear-the-way-for-ransomware-infection\/"},"modified":"2025-12-08T10:04:29","modified_gmt":"2025-12-08T10:04:29","slug":"shanya-edr-killer-leveraged-by-ransomware-groups-to-clear-the-way-for-ransomware-infection","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/12\/08\/shanya-edr-killer-leveraged-by-ransomware-groups-to-clear-the-way-for-ransomware-infection\/","title":{"rendered":"Shanya EDR Killer Leveraged by Ransomware Groups to Clear the Way for Ransomware Infection"},"content":{"rendered":"

Shanya EDR Killer Leveraged by Ransomware Groups to Clear the Way for Ransomware Infection
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

The cybercriminal landscape has recently witnessed the aggressive rise of \u201cShanya,\u201d a potent packer-as-a-service and EDR killer now fueling major ransomware operations.<\/p>\n

Emerging on underground forums in late 2024 under the alias \u201cVX Crypt,\u201d this tool was engineered to supersede previous market leaders like HeartCrypt.<\/p>\n

Shanya effectively bridges the critical gap between initial access and final payload deployment, offering attackers a specialized toolkit designed specifically to blind security monitors and guarantee successful encryption.<\/p>\n

Shanya operates through sophisticated DLL side-loading techniques, often compromising legitimate system binaries such as consent.exe<\/code> to mask its execution.<\/p>\n

Central to its attack methodology is the \u201cBring Your Own Vulnerable Driver\u201d (BYOVD) tactic.<\/p>\n

By dropping and exploiting legitimate but vulnerable drivers\u2014most notably ThrottleStop.sys<\/code>\u2014the malware gains kernel-level privileges.<\/p>\n

This elevation is critical, allowing it to bypass standard user-mode restrictions and directly attack the kernel callbacks used by endpoint protection platforms.<\/p>\n

Sophos security analysts identified<\/a> the malware\u2019s escalating usage across global campaigns, linking it to high-profile ransomware families including Akira, Medusa, and Qilin.<\/p>\n

The researchers noted that Shanya is not merely a protective packer but a proactive offensive weapon.<\/p>\n

\n
\"The
The process by which the EDR killer clears the way for a ransomware infection (Source \u2013 Sophos)<\/figcaption><\/figure>\n<\/div>\n

It systematically dismantles defenses before the ransomware<\/a> payload is even decrypted, creating a defenseless environment where encryption processes can run uninterrupted.<\/p>\n

This dual-functionality has made it particularly prevalent in targeted attacks across regions like the UAE and Tunisia.<\/p>\n

Infection Dynamics and Kernel-Level Evasion<\/strong><\/h2>\n

Shanya\u2019s technical architecture reveals a heavy reliance on advanced obfuscation<\/a> and anti-analysis mechanisms to survive scrutiny.<\/p>\n

The initial loader is saturated with \u201cjunk code\u201d to disrupt reverse engineering efforts.<\/p>\n

\n
\"The
The junk code flows like a river (Source \u2013 Sophos)<\/figcaption><\/figure>\n<\/div>\n

To further evade detection, the malware proactively calls RtlDeleteFunctionTable<\/code> with invalid contexts, attempting to crash debuggers.<\/p>\n

It also conceals its configuration data within the Process Environment Block (PEB), utilizing the GdiHandleBuffer<\/code> as a covert repository for API pointers, ensuring critical execution parameters remain hidden from memory scanners.<\/p>\n

A defining characteristic of Shanya is its ruthless process termination capability. Once the kernel driver is active, the user-mode component initiates a scan of active services against a target list.<\/p>\n

\n
\"Attempting
Attempting to smite the security products it finds (Source \u2013 Sophos)<\/figcaption><\/figure>\n<\/div>\n

The malware iterates through these services, sending instructions to the kernel driver (hlpdrv.sys<\/code>) to forcibly terminate them.<\/p>\n

\/\/ Logic for iterating and terminating security services\nwhile (!StrStrIA (v5, v6)) \n{\n    v6 = (&driver_list) [++v7]; \/\/ Iterate through target list\n    if (!v6) goto LABEL_14;\n}\n\/\/ DeviceIoControl sends kill command to malicious driver\nif (!DeviceIoControl (hDevice, 0x222008u, &InBuffer, 8u, ...)) \n{\n    \/\/ Trigger termination routine\n}<\/code><\/pre>\n
The malware also employs a unique \u201cdouble loading\u201d technique, loading a second instance of a system DLL like shell32.dll<\/code> and overwriting its header with the decrypted payload.<\/p>\n
This seamless integration into legitimate memory spaces, often using names like mustard64.dll<\/code>, exemplifies the advanced evasion tactics<\/a> that make Shanya a critical threat.<\/p>\n
Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n
The post Shanya EDR Killer Leveraged by Ransomware Groups to Clear the Way for Ransomware Infection<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n
 \t

\n 
<\/BR>
\n    Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
Shanya EDR Killer Leveraged by Ransomware Groups to Clear the Way for Ransomware Infection The cybercriminal landscape has recently witnessed the aggressive rise of \u201cShanya,\u201d a potent packer-as-a-service and EDR killer now fueling major ransomware operations. Emerging on underground forums in late 2024 under the alias \u201cVX Crypt,\u201d this tool was engineered to supersede previous […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-9017","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9017"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=9017"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9017\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=9017"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=9017"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=9017"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}