Hackers Use Windows Tools to Disable Antivirus Before Ransomware Attacks

Key Takeaways

• Ransomware groups are increasingly using legitimate Windows administration tools to disable antivirus and EDR solutions.
• These tactics allow threat actors to bypass security defenses, making ransomware attacks harder to detect and more destructive.
• Widely used utilities like Process Hacker, IOBit Unlocker, PowerRun, and AuKill are being repurposed for malicious activities.
• The attacks involve a two-stage process: first, neutralizing security software and escalating privileges; then, stealing credentials, manipulating the kernel, and deploying ransomware.
• Organizations should implement strong authentication, application whitelisting, and vigilant monitoring for suspicious administrative commands to mitigate this threat.

Ransomware campaigns have evolved significantly, moving beyond simple malicious code to embrace highly sophisticated tactics. Threat actors are now systematically leveraging legitimate Windows utilities to dismantle security defenses before initiating ransomware attacks, a trend thoroughly documented in a recent report. This strategic shift has rendered modern ransomware attacks both more difficult to detect and significantly more damaging to victim organizations.

The tools being weaponized were originally designed for legitimate IT management. Utilities such as Process Hacker, IOBit Unlocker, PowerRun, and AuKill serve purposes like managing system processes, unlocking locked files, and troubleshooting. However, attackers have ingeniously repurposed these tools to silently terminate antivirus and endpoint detection and response (EDR) software before unleashing their ransomware payloads. Because these utilities are often digitally signed and commonly found in enterprise environments, security systems frequently classify their operations as standard administrative activities, thereby minimizing detection and leaving scant forensic traces.

Researchers at Seqrite have identified this escalating trend, highlighting that the exploitation of legitimate low-level tools has become a hallmark of contemporary ransomware operations. This includes prominent families like LockBit 3.0, BlackCat, Dharma, Phobos, and MedusaLocker. The research underscores that threat actors are not solely relying on custom-built malware but are meticulously profiling their targets, pinpointing security vulnerabilities, and weaponizing the very tools intended to maintain system integrity.

Disabling antivirus software is no longer a peripheral action in these attacks; it is a meticulously planned and critical component of the overall strategy. Active security software can prevent the execution of malicious payloads, detect anomalous encryption behaviors, and provide real-time alerts to security teams. By preemptively deactivating these defenses, attackers establish an unmonitored window during which ransomware can operate unimpeded. This evasion technique has progressed from rudimentary command-line scripts used by early threats such as CryptoLocker and WannaCry, through kernel-level driver manipulation observed in Conti and LockBit 2.0, to the current integration of prepackaged antivirus killer modules directly within ransomware-as-a-service (RaaS) kits.

This threat impacts organizations of all sizes, from small businesses to large enterprises. The attack methodology consistently follows a deliberate sequence, exploiting trusted tools at each phase to evade detection.

The Two-Stage Abuse of Legitimate Windows Tools

Once threat actors establish initial access, they execute a precise two-stage process to systematically dismantle security measures before the ransomware payload is ever deployed.

Stage 1: Antivirus Neutralization and Privilege Escalation

The primary objective of the first stage is complete neutralization of antivirus software and escalation of privileges. Tools like IOBit Unlocker are used to delete antivirus binaries via the NtUnlockFile API. TDSSKiller, originally designed for rootkit removal, is repurposed to unload antivirus kernel drivers, preventing their re-initialization. Process Hacker exploits SeDebugPrivilege to terminate antivirus processes, while Atool_ExperModel deletes antivirus startup registry entries, disrupting scheduled tasks and eliminating persistence mechanisms.

Stage 2: Credential Theft, Kernel Manipulation, and Ransomware Deployment

The second stage marks the most critical phase of the attack. With security software neutralized, attackers pivot to credential theft, kernel manipulation, and ransomware deployment. YDArk hooks kernel-level callbacks to establish stealthy persistence. PowerRun is then employed to execute the ransomware payload with full SYSTEM-level privileges. Mimikatz is used to extract cached administrator credentials from LSASS memory, facilitating lateral movement across the network. Finally, Unlock_IT erases registry entries and forensic traces to cover the attackers’ tracks, and AuKill explicitly terminates any remaining EDR processes. With both stages successfully completed, the environment is fully compromised, allowing for silent, large-scale file encryption without any active defenses to intervene.

What You Should Do

• Implement Multi-Factor Authentication (MFA): Enforce MFA for all privileged accounts and critical systems to prevent unauthorized access even if credentials are stolen.
• Enable Application Whitelisting: Utilize application whitelisting policies to block the execution of unapproved utilities, including those commonly abused by attackers.
• Monitor for Suspicious Commands: Actively monitor for suspicious administrative commands such as sc stop, net stop, and taskkill, which are often used to disable security services.
• Audit Registry Changes: Regularly audit registry changes related to antivirus and system startup configurations to detect unauthorized modifications.
• Limit Administrative Tool Access: Restrict access to low-level administrative tools to only vetted personnel with a legitimate need.
• Train Security Operations Center (SOC) Analysts: Educate SOC analysts to recognize early indicators of defense neutralization and the abuse of legitimate tools.
• Isolate Affected Endpoints: Immediately isolate any endpoint suspected of compromise to prevent lateral movement and contain the attack’s impact.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.