Phobos and MedusaLocker: Hackers Weaponize Legitimate Windows Tools to Disable Antivirus Before Ransomware Attacks

Modern Ransomware Attacks Exploit Trusted Windows Tools to Disable Security Defenses

Ransomware operations have evolved into sophisticated, business-like campaigns that leverage legitimate Windows utilities to dismantle security protections before deploying malicious payloads. Attackers now repurpose tools such as Process Hacker, IOBit Unlocker, PowerRun, and AuKill originally designed for IT administration to silently terminate antivirus and endpoint detection and response (EDR) software.

Because these tools are digitally signed and commonly used in enterprise environments, security systems often overlook their malicious activity, treating it as routine administrative work. This tactic has become a hallmark of major ransomware groups, including LockBit 3.0, BlackCat, Dharma, Phobos, and MedusaLocker, which combine custom malware with the weaponization of trusted system utilities.

The attack sequence follows a deliberate two-stage process. In the first stage, threat actors neutralize security software by:

• Deleting antivirus binaries using IOBit Unlocker’s NtUnlockFile API.
• Unloading antivirus kernel drivers via repurposed tools like TDSSKiller.
• Terminating antivirus processes by exploiting SeDebugPrivilege with Process Hacker.
• Removing persistence mechanisms by deleting registry entries with Atool_ExperModel.

Once defenses are disabled, attackers escalate privileges and move laterally. The second stage involves:

• Credential theft using Mimikatz to extract cached administrator credentials from LSASS memory.
• Kernel manipulation with tools like YDArk to maintain stealth persistence.
• Ransomware execution at SYSTEM-level privileges via PowerRun.
• Evidence removal using Unlock_IT and AuKill to erase forensic traces and terminate remaining EDR processes.

This approach allows ransomware to encrypt files undetected, with no active defenses left to intervene. The shift from basic scripts (e.g., CryptoLocker, WannaCry) to kernel-level driver manipulation (e.g., Conti, LockBit 2.0) and now prepackaged "antivirus killer" modules in ransomware-as-a-service (RaaS) kits has made these attacks more effective and harder to detect.

Organizations of all sizes remain at risk, as attackers systematically exploit trusted tools to bypass security measures before encryption begins.

Source: https://cybersecuritynews.com/hackers-weaponize-legitimate-windows-tools/

Phobos TPRM report: https://www.rankiteo.com/company/phobosgroup

MedusaLocker TPRM report: https://www.rankiteo.com/company/plume-security-inc

"id": "plupho1774967207",
"linkid": "plume-security-inc, phobosgroup",
"type": "Ransomware",
"date": "3/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'attack_vector': 'Legitimate Windows utilities (Process Hacker, IOBit '
                  'Unlocker, PowerRun, AuKill)',
 'data_breach': {'data_encryption': 'Files encrypted by ransomware'},
 'description': 'Ransomware operations have evolved into sophisticated, '
                'business-like campaigns that leverage legitimate Windows '
                'utilities to dismantle security protections before deploying '
                'malicious payloads. Attackers repurpose tools such as Process '
                'Hacker, IOBit Unlocker, PowerRun, and AuKill to silently '
                'terminate antivirus and endpoint detection and response (EDR) '
                'software. This tactic is used by major ransomware groups '
                'including LockBit 3.0, BlackCat, Dharma, Phobos, and '
                'MedusaLocker, combining custom malware with weaponized system '
                'utilities to bypass security measures.',
 'impact': {'operational_impact': 'Disabling of security defenses, lateral '
                                  'movement, and encryption of files'},
 'lessons_learned': 'Attackers exploit trusted system tools to bypass security '
                    'defenses, requiring enhanced monitoring of legitimate '
                    'utilities and kernel-level activity.',
 'motivation': 'Financial gain (ransomware extortion)',
 'post_incident_analysis': {'corrective_actions': 'Enhanced monitoring of '
                                                  'administrative tools, '
                                                  'kernel-level threat '
                                                  'detection, and stricter '
                                                  'access controls.',
                            'root_causes': 'Abuse of legitimate Windows '
                                           'utilities and kernel-level '
                                           'manipulation to disable security '
                                           'defenses.'},
 'ransomware': {'data_encryption': 'Yes',
                'ransomware_strain': ['LockBit 3.0',
                                      'BlackCat',
                                      'Dharma',
                                      'Phobos',
                                      'MedusaLocker']},
 'recommendations': 'Implement stricter controls on the use of administrative '
                    'tools, monitor for unusual process termination, and '
                    'enhance kernel-level threat detection.',
 'threat_actor': ['LockBit 3.0',
                  'BlackCat',
                  'Dharma',
                  'Phobos',
                  'MedusaLocker'],
 'title': 'Modern Ransomware Attacks Exploit Trusted Windows Tools to Disable '
          'Security Defenses',
 'type': 'Ransomware',
 'vulnerability_exploited': 'Abuse of trusted system tools and kernel-level '
                            'driver manipulation'}