Incident Overview

The threat actor claims to be selling an AV/EDR Killer malware tool advertised as capable of disabling and removing multiple enterprise security products. The malware allegedly targets major antivirus and endpoint detection and response (EDR) solutions commonly deployed in corporate environments.

According to the threat actor's advertisement, the tool claims to be effective against the following security products:

• SentinelOne
• Microsoft Defender for Endpoint (MDE)
• Sophos Endpoint Security
• ESET Endpoint Security
• Trend Micro
• Avast Business
• Avira Pro

The offering is advertised as including code, a builder tool, and a Microsoft-signed driver dated 2025. The threat actor claims the tool has been tested against the listed security products. The price is listed at $3,000, with payment details provided via a TOX messaging ID.

Tools designed to disable security software are commonly used by ransomware operators and other threat actors to evade detection and maintain persistence on compromised systems. Such tools often exploit legitimate drivers or use code-signing certificates to bypass security controls.