Aukill

AuKill, a malicious software (malware) developed by the notorious cybercrime collective FIN7, has been identified as a significant threat to endpoint security. The malware was designed to exploit a vulnerable version of a driver for Microsoft's Process Explorer utility, thereby disabling endpoint protection products. This tool was first reported in April 2023 when it was used in multiple attacks attempting to deploy Medusa Locker and LockBit ransomware. AuKill, also known as AvNeutralizer, was exclusively used by a single group for six months, targeting various endpoint security solutions. The development of AuKill began in April 2022 by FIN7, a largely Russian-Ukrainian operation that has been carrying out financially motivated cyber campaigns across industries since 2012. This tool has the ability to bypass security solutions, and its new feature specifically targets the protected processes run by Endpoint Detection and Response (EDR) solutions. In July 2023, Sophos behavioral rules were triggered by activity from a driver for another company's security product, indicating that sometimes vulnerable drivers can be detected before exploitation. In recent times, AuKill has seen a surge in usage and is becoming increasingly popular among high-level ransomware groups. It was discovered being sold commercially on the Dark Web by Sophos X-Ops, indicating its widespread availability to cybercriminals. A report from SentinelOne further highlights the growing prevalence of AuKill, underscoring the need for continued vigilance and proactive measures to counter this evolving threat.