FIN7: “EDR-Killer” For Sale

by: Bryson Medlock

FIN7, a well-known Russian cybercrime group that has been active since 2013, has developed a sophisticated tool, dubbed? "AvNeutralizer”, aimed at disabling endpoint detection and response (EDR) systems, enabling attackers to evade detection within compromised networks. This "AvNeutralizer” exploits vulnerabilities in EDR products, highlighting the evolving nature of cyberthreats, and it has been in use by BlackBasta ransomware operations, believed to have a connection with FIN7, since 2022. The emergence of this tool is a stark reminder of the need for a comprehensive and layered security approach to effectively protect against such advanced threats.?

In addition to using “AvNeutralizer” for their own operations, FIN7 is reportedly now selling this tool to other threat actors. Since early 2023, “AvNeutralizer” has been used by ransomware RaaS payloads such as AvosLocker, MedusaLocker, BlackCat, Trigona, and LockBit. This commercialization of advanced cyber tools could lead to an increase in cyberattacks, as more criminals gain access to high-level capabilities. However, this trend underscores the importance of not relying solely on EDR systems for cybersecurity. While EDR solutions are vital for detecting and responding to threats, they should be part of a broader, integrated security strategy that includes multiple layers of defense.?

A layered security strategy involves the integration of various tools and practices to create a robust defense system. Beyond EDR solutions, organizations should incorporate security information and event management (SIEM) systems for real-time analysis of security alerts and use a 24/7 security operations center (SOC) for continuous monitoring and response. Additionally, adopting secure access service edge (SASE) frameworks can enhance security by providing a cloud-native architecture that combines network and cybersecurity functions. Regular backups are also essential to ensure data recovery in case of an attack, minimizing the impact of data loss and ransomware incidents.?

The development of FIN7's EDR Killer tool highlights the necessity for a comprehensive and proactive approach to cybersecurity. By adopting a layered security strategy that includes EDR, SIEM, SASE, regular backups, and a 24/7 SOC, organizations can significantly improve their ability to safeguard networks and data. Staying informed through continuous threat intelligence and adapting to the evolving threat landscape are crucial steps in maintaining robust cybersecurity defenses against groups like FIN7.?

Visit the ConnectWise Trust Center for the latest advisories and helpful links. ?