TA Phone Home: EDR Evasion Testing Reveals Extortion Actor's Toolkit
Summary: Unit 42 investigated an extortion incident in which a threat actor bought access to a client network via Atera RMM from an initial access broker, then installed older Cortex XDR agents on rogue virtual systems to test an AV/EDR bypass tool. That tool, disabler.exe, appears to reuse EDRSandBlast source code with small modifications and loads a vulnerable driver, wnbios.sys or WN_64.sys, to remove user-mode hooks and kernel-mode callbacks.
What you should know: The actor's own OpSec failure - demonstration videos and a Kazakhstan P-1 invoice left on the rogue system - let Unit 42 tie the tool's seller, KernelMode, to a named individual, but the same tool was sold by subscription on XSS and Exploit and tested against multiple endpoint products, so the bypass capability is not confined to this one intrusion.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026