Loading malware…
DemoKiller is a commercial Windows EDR-killer used in ransomware intrusions to disable or terminate endpoint security products prior to payload deployment. It is marketed in underground criminal ecosystems as an anti-EDR service and has been observed in operations conducted by affiliates associated with multiple ransomware groups, including Qilin, Akira, and Gentlemen, as well as in at least one RansomHouse intrusion. Available reporting indicates it is affiliate-selected tooling rather than a proprietary component of the Gentlemen ransomware operators’ in-house suite.
DemoKiller belongs to the broader class of defense-evasion utilities that are deployed after attackers obtain elevated privileges and before ransomware execution. Its purpose is to neutralize EDR and related protections, enabling subsequent post-compromise activity with reduced detection and response. It is discussed alongside other commercialized EDR-killer offerings, reflecting the growing specialization and commoditization of anti-security tooling in the ransomware ecosystem.
The malware targets Windows environments. High-confidence reporting supports its role in defense evasion, but specific implementation details, delivery vector, and additional capabilities beyond EDR disabling are not currently available from the supplied facts.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The threat actor advertised an EDR killer that ESET researchers later named DemoKiller. ESET telemetry confirms that DemoKiller has been used by affiliates of the Qilin, Akira, and Gentlemen gangs...
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Before launching their file-encrypting malware, cybercriminals routinely deploy specialized tools to bypass security software... Attackers are now heavily using driverless methods, custom command-line scripts, and legitimate anti-rootkit utilities to turn off security defenses.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An EDR killer observed in several intrusions but treated as affiliate-specific tooling rather than part of the Gentlemen-maintained suite.
An affiliate-specific EDR killer observed in some intrusions but explicitly not tied to Gentlemen's maintained suite.
A commercialized EDR killer marketed on underground marketplaces as a service to disable security tools.
Commercial EDR killer sold underground and used by multiple ransomware affiliates across several gangs.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.