HavocKiller
HavocKiller, also referred to as HwAudKiller, is a BYOVD-based EDR-killing tool used in ransomware-related intrusions. Public disclosure was made by Huntress on 2026-03-19, while ESET telemetry placed real-world use as early as 2026-01-23. The tool abuses a Huawei Audio driver, identified as havoc.sys, to disable or terminate security tooling. ESET reported that the Gentlemen ransomware-as-a-service operation incorporated HavocKiller as part of its broader affiliate-facing EDR-killer arsenal alongside HexKiller and ThrottleBlood, and assessed these tools as externally sourced rather than developed in-house. Within Gentlemen intrusions, HavocKiller was standardized through the group’s shared defense-evasion layer, including masquerading as security-vendor software and use of protections such as Enigma or Themida. High-confidence context ties HavocKiller to ransomware operations and specifically to Gentlemen activity, but the provided content does not include a standalone process target list, infection vector, or additional HavocKiller-specific IOCs beyond the havoc.sys driver name and the HwAudKiller alias.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
HavocKiller / HwAudKiller The most recent addition to the suite. Huntress publicly disclosed HavocKiller on 19 March 2026 , but ESET’s own telemetry shows real-world use dating back to at least 23 January 2026.
The group also incorporates third-party or leaked tools named HexKiller, ThrottleBlood and HavocKiller.
Techniques & procedures
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
ESET’s assessment is that all three were acquired externally by the operators and then standardized with the same defense evasion layer applied to GentleKiller: binary protection via Enigma or Themida, filenames mimicking security vendors, fabricated version information, copied digital signatures, and matching icons.
Execution
2 techniques
Execution
Persistence
1 technique
Persistence
Stage 4 – Driver installation as a persistence/elevation step (T1543.003 – Create or Modify System Process: Windows Service). Each tool installs and starts its associated vulnerable or outright malicious kernel-mode driver as a Windows service before exploitation occurs.
Privilege Escalation
2 techniques
Privilege Escalation
The technique used is Bring Your Own Vulnerable Driver (BYOVD), loading a legitimately signed but exploitable driver to terminate security processes at the kernel level, bypassing user-mode protections.
Stage 4 – Driver installation as a persistence/elevation step (T1543.003 – Create or Modify System Process: Windows Service). Each tool installs and starts its associated vulnerable or outright malicious kernel-mode driver as a Windows service before exploitation occurs.
Stealth
5 techniques
Stealth
Defense Evasion T1027 Obfuscated Files or Information Some executables are protected with packers (Enigma, Themida) and custom control-flow obfuscation.
All three tools are standardized through a shared defense-evasion layer that applies Enigma or Themida binary protectors...
Stage 7 – Masquerading and obfuscation layered over the whole chain (T1036, T1036.001, T1027 – Masquerading, Masquerading: Invalid Code Signature, Obfuscated Files or Information). Every tool in the suite ... is run through the same standardization layer: commercial packers (Enigma/Themida), fabricated version information, icons copied from the impersonated vendor, and digital signatures copied from legitimate software.
Defense Impairment
1 technique
Defense Impairment
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A third-party EDR killer adapted into Gentlemen’s portfolio and wrapped with Gentlemen’s evasion layer. It abuses a vulnerable driver impersonating Huawei’s audio stack to disable endpoint defenses during ransomware activity.
An EDR killer integrated into Gentlemen’s suite that abuses a Huawei Audio driver to evade or disable endpoint defenses.
A third-party EDR-killer tool later publicly disclosed by Huntress, but already in use during Gentlemen intrusions before disclosure.
A BYOVD-based EDR killer incorporated by The Gentlemen as a third-party or leaked tool for terminating security products.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.