A malicious actor is selling a tool called Terminator that they claim can bypass antivirus and EDR software. The tool is reportedly able to bypass 24 different security solutions, including Windows Defender, on devices running Windows 7 and later.<\/p>\n\n\n\n
The author of Terminator, who goes by the pseudonym “Spyboy,” sells the tool for prices ranging from $300 for a single bypass to $3,000 for an all-in-one bypass.<\/p>\n\n\n\n
In order to use Terminator, clients require administrative privileges<\/a> on the target Windows systems. This can be done by tricking the user into accepting the Windows User Account Control (UAC) pop-up that will be displayed when the tool is launched.<\/p>\n\n\n\n A CrowdStrike engineer<\/a> found that Terminator is actually a simple tool that dumps a legitimate signed Zemana antivirus driver into the target system. The driver is then loaded to obtain elevated privileges in order to terminate the processes of antivirus, EDR and XDR programs running on the device.<\/p>\n\n\n\n Currently, only one VirusTotal<\/a> scan engine detects this driver as malicious. <\/p>\n\n\n\n Twitter user S0ufi4n3<\/a> shared links to the videos supposedly showing Terminator in action <\/p>\n\n\n\n Here are some additional tips for protecting your system from Terminator and other malware threats:<\/p>\n\n\n\n Source: https:\/\/gridinsoft.com\/blogs\/terminator-and-<\/a>antivirus<\/a>-programs\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":" A malicious actor is selling a tool called Terminator that they claim can bypass antivirus and EDR software. <\/p>\n","protected":false},"author":2,"featured_media":3102,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[82,81,27],"class_list":["post-3101","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-av","tag-edr","tag-security"],"_links":{"self":[{"href":"https:\/\/krsp.co\/agency\/wp-json\/wp\/v2\/posts\/3101","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/krsp.co\/agency\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/krsp.co\/agency\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/krsp.co\/agency\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/krsp.co\/agency\/wp-json\/wp\/v2\/comments?post=3101"}],"version-history":[{"count":4,"href":"https:\/\/krsp.co\/agency\/wp-json\/wp\/v2\/posts\/3101\/revisions"}],"predecessor-version":[{"id":3106,"href":"https:\/\/krsp.co\/agency\/wp-json\/wp\/v2\/posts\/3101\/revisions\/3106"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/krsp.co\/agency\/wp-json\/wp\/v2\/media\/3102"}],"wp:attachment":[{"href":"https:\/\/krsp.co\/agency\/wp-json\/wp\/v2\/media?parent=3101"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/krsp.co\/agency\/wp-json\/wp\/v2\/categories?post=3101"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/krsp.co\/agency\/wp-json\/wp\/v2\/tags?post=3101"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
https:\/\/streamable.com\/h9n16x<\/a>
https:\/\/streamable.com\/ys07we<\/a><\/p>\n\n\n\n\n