Qilin EDR killer infection chain
Summary: Cisco Talos analyzed a malicious msimg32.dll used in Qilin ransomware attacks that side-loads through a legitimate application and runs a multi-stage chain to disable endpoint detection and response tools. The loader neutralizes user-mode hooks, suppresses ETW events, overwrites the ntdll .mrdata exception dispatcher, and loads two helper drivers, rwdrv.sys for physical memory access and hlpdrv.sys to terminate EDR processes, with the malware capable of disabling over 300 EDR drivers across vendors.
Key Takeaway: The chain unregisters the EDR's own monitoring callbacks before killing its processes, so the tool an organization relies on to see the attack is turned off first, and coverage of more than 300 drivers means vendor choice alone is not a defense.
Read the original at Cisco Talos ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026