RansomHub ransomware gang relies on Kaspersky TDSKiller tool to disable EDR

Researchers observed the RansomHub ransomware group using the TDSSKiller tool to disable endpoint detection and response (EDR) systems.

The RansomHub ransomware gang is using the TDSSKiller tool to disable endpoint detection and response (EDR) systems, Malwarebytes ThreatDown Managed Detection and Response (MDR) team observed.

TDSSKiller a legitimate tool developed by the cybersecurity firm Kaspersky to remove rootkits, the software could also disable EDR solutions through a command line script or batch file.

The experts noticed that the ransomware group also used the LaZagne tool to harvest credentials. During the case investigated by MDR, experts observed that LaZagne generated 60 file writes, likely logging extracted credentials, and performed 1 file deletion, likely to hide traces of the credential-harvesting activity.

“Although both TDSSKiller and LaZagne have been used by attackers for years, this is the first record of RansomHub using them in its operations, with the TTPs not listed in CISA’s recently published advisory on RansomHub.” reads the Malwarebytes MDR’s report. “The tools were deployed following initial reconnaissance and network probing through admin group enumeration, such as net1 group "Enterprise Admins" /do. “

RansomHub used TDSSKiller with the -dcsvc flag to try disabling critical security services, specifically targeting Malwarebytes Anti-Malware Service (MBAMService). The command aimed to disrupt security defenses by disabling this service.

Command line: tdsskiller.exe -dcsvc MBAMService where the -dcsvc flag was used to target specific services. In this instance, attackers attempted to disable MBAMService.

RansomHub is a ransomware as a service (RaaS) that was employed in the operations of multiple threat actors. Microsoft reported that RansomHub was observed being deployed in post-compromise activity by the threat actor tracked as Manatee Tempest following initial access by Mustard Tempest via FakeUpdates/Socgholish infections.

Experts believe RansomHub is a rebrand of the Knight ransomware. Knight, also known as Cyclops 2.0, appeared in the threat landscape in May 2023. The malware targets multiple platforms, including Windows, Linux, macOS, ESXi, and Android. The operators used a double extortion model for their RaaS operation.

This isn’t the first time that security experts documented the use of the tool developed by Kaspersky.

The Sangfor Cyber Guardian Incident Response team reported that the LockBit ransomware gang used the -dcsvc parameter of TDSSKiller as part of their attack chain.

Attackers use legitimate tools because are not blocked by security solutions.

Malwarebytes shared indicators of compromise (IoCs) for these attacks and recommends:

• Isolate critical systems through network segmentation to limit lateral movement.
• Restrict Bring Your Own Vulnerable Driver (BYOVD) exploits by implementing controls to monitor and restrict vulnerable drivers like TDSSKiller, especially when executed with suspicious command-line flags such as -dcsvc. Quarantining or blocking known misuse patterns while allowing legitimate uses can prevent BYOVD attacks.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, RansomHub ransomware)