Terminator

Terminator is a Windows defense-evasion utility marketed in criminal forums and used in intrusions to disable antivirus, EDR, and XDR products through a bring-your-own-vulnerable-driver (BYOVD) technique. It is associated with the threat actor Spyboy, who advertised it in 2023 as a service capable of terminating multiple security products, and it has also been observed in ransomware operations including activity linked to Akira. Terminator is not a novel kernel exploit framework so much as an operationalized wrapper around abuse of legitimate signed but vulnerable Zemana drivers to gain kernel-level capability and kill protected user-mode security processes.

The tool requires administrative privileges and, in reported tradecraft, installation of the vulnerable driver may depend on user approval of a UAC prompt or other means of obtaining elevated execution. Terminator drops and loads a signed Zemana driver, then abuses insufficient validation in the driver’s IOCTL handling to add an attacker-controlled process to an allow list and request privileged actions, including termination of targeted security processes. Multiple variants and derivatives have been tracked, including open-source Terminator builds as well as reimplementations such as SharpTerminator and Ternimator, indicating that the codebase has been adapted, repackaged, and obfuscated by different actors.

Observed use shows Terminator functioning primarily as a post-compromise defense-evasion tool rather than an initial access mechanism. In ransomware intrusions, attackers have attempted to use it after gaining privileged access in order to neutralize endpoint protections before deploying follow-on payloads. Akira operators were observed attempting to use the open-source version shortly after its public release, although at least some EDR products and Microsoft Defender detected the tool without losing protection. Other incidents show attackers modifying Terminator-derived binaries, pairing them with separately dropped vulnerable drivers, or switching to alternative BYOVD tools such as AuKill when Zemana-driver-based attempts failed.

Terminator exemplifies the broader commoditization of BYOVD tradecraft. Its appeal lies in using legitimate signed drivers with known vulnerabilities to obtain kernel-level influence without developing a custom driver. This makes it useful to ransomware affiliates and other criminal operators seeking reliable security-tool termination on Windows endpoints. The malware’s practical role is to facilitate later-stage actions by weakening host defenses, enabling execution of ransomware, cryptominers, or other payloads.