Video wird geladen...

Video konnte nicht geladen werden

Zur Startseite

1/2🚨 Threat actor advertising "AV/EDR Killer" tool on a dark web forum - claims to disable multiple enterprise security solutions. Industry: Malware-as-a-Service Type: Security Evasion Tool Threat Actor: deadFrog Samples: Yes The seller claims their tool can kill and disable numerous antivirus and endpoint detection/response (EDR) products used by...

DarkWebInformer's profile picture

Dark Web Informer

173,724 subscribers

40,219 Aufrufe • vor 8 Monaten •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

0 Kommentare

Keine Kommentare verfügbar

Kommentare vom Original-Post werden hier angezeigt

Ähnliche Videos

⚠️ A defense evasion tool called ExEngine is being sold as a service, marketed as an AV/EDR killer that disables mainstream consumer security software including Windows Defender, Malwarebytes, Bitdefender, and Avast. The tool combines AV termination with a Ring-3 rootkit, UAC bypass, and decoy payload delivery to support stealthy initial access operations. ⠀ ‣ Threat Actor: ryewx1 ‣ Category: Defense Evasion Tool / Killer ‣ Offering: ExEngine AV/EDR Killer ‣ Industry: Malware Tooling ⠀ The seller claims ExEngine actively terminates security software rather than only obfuscating payloads, granting attackers a longer window of undetected operation. The tool supports Windows 10 and 11 builds and is sold per-build at $150 to $250. ⠀ Advertised capabilities: ⠀ ▪️ AV/EDR termination with primary and fallback techniques ▪️ UAC bypass with automatic privilege escalation ▪️ Ring-3 rootkit functionality to hide files, processes, registry keys, and network connections ▪️ Discord webhook logging for victim machine info and execution status ▪️ Secondary decoy payload (game/document/installer) to keep targets unaware ▪️ Persistence across reboots and logouts ▪️ Anti-VM and anti-debug detection with fake error message exit ▪️ Universal Windows 10/11 support, all payload types ⠀ Risk to defenders: ⠀ ▪️ Active termination of consumer AV products including Windows Defender means traditional endpoint protections cannot be relied on once ExEngine executes successfully ▪️ Decoy payload pattern is designed to delay user-driven incident reporting, lengthening attacker dwell time ▪️ Ring-3 rootkit hiding of files, processes, and network connections complicates incident response triage on compromised hosts ▪️ Discord webhook telemetry indicates the operator is targeting consumer and SMB victims at scale rather than running individual targeted campaigns ▪️ Sold per-build at low cost ($150 to $250), making it accessible to low-skill operators who can pair it with commodity stealers, RATs, or loaders
0:57

⚠️ A defense evasion tool called ExEngine is being sold as a service, marketed as an AV/EDR killer that disables mainstream consumer security software including Windows Defender, Malwarebytes, Bitdefender, and Avast. The tool combines AV termination with a Ring-3 rootkit, UAC bypass, and decoy payload delivery to support stealthy initial access operations. ⠀ ‣ Threat Actor: ryewx1 ‣ Category: Defense Evasion Tool / Killer ‣ Offering: ExEngine AV/EDR Killer ‣ Industry: Malware Tooling ⠀ The seller claims ExEngine actively terminates security software rather than only obfuscating payloads, granting attackers a longer window of undetected operation. The tool supports Windows 10 and 11 builds and is sold per-build at $150 to $250. ⠀ Advertised capabilities: ⠀ ▪️ AV/EDR termination with primary and fallback techniques ▪️ UAC bypass with automatic privilege escalation ▪️ Ring-3 rootkit functionality to hide files, processes, registry keys, and network connections ▪️ Discord webhook logging for victim machine info and execution status ▪️ Secondary decoy payload (game/document/installer) to keep targets unaware ▪️ Persistence across reboots and logouts ▪️ Anti-VM and anti-debug detection with fake error message exit ▪️ Universal Windows 10/11 support, all payload types ⠀ Risk to defenders: ⠀ ▪️ Active termination of consumer AV products including Windows Defender means traditional endpoint protections cannot be relied on once ExEngine executes successfully ▪️ Decoy payload pattern is designed to delay user-driven incident reporting, lengthening attacker dwell time ▪️ Ring-3 rootkit hiding of files, processes, and network connections complicates incident response triage on compromised hosts ▪️ Discord webhook telemetry indicates the operator is targeting consumer and SMB victims at scale rather than running individual targeted campaigns ▪️ Sold per-build at low cost ($150 to $250), making it accessible to low-skill operators who can pair it with commodity stealers, RATs, or loaders

Dark Web Informer

23,567 Aufrufe • vor 4 Monaten

🛠️ AsmLdr Shellcode loader for Windows x64 environments. Execute encrypted payloads while minimizing detection by advanced antivirus software, endpoint detection and response (EDR) systems, sandboxes, and debuggers Try:
0:54

🛠️ AsmLdr Shellcode loader for Windows x64 environments. Execute encrypted payloads while minimizing detection by advanced antivirus software, endpoint detection and response (EDR) systems, sandboxes, and debuggers Try:

International Cyber Digest

13,575 Aufrufe • vor 10 Monaten

As intelligence continues to evolve, integrating intelligence into network security is the optimal path forward. Huawei's three-layer cloud-edge-endpoint architecture upgrades the Xinghe AI Unified SASE Solution, enabling enterprises worldwide to build all-scenario intelligent defense systems with smarter security and more efficient operations
0:35

As intelligence continues to evolve, integrating intelligence into network security is the optimal path forward. Huawei's three-layer cloud-edge-endpoint architecture upgrades the Xinghe AI Unified SASE Solution, enabling enterprises worldwide to build all-scenario intelligent defense systems with smarter security and more efficient operations

Huawei Network

24,966,426 Aufrufe • vor 6 Monaten

‼️A malware binder tool branded "Universal File Binder 2026" is being sold on a popular cybercrime forum, advertised as fully undetectable and designed to disguise executable payloads as common file types including documents, images, and videos. ⠀ ‣ Threat Actor: Davina Keenan ‣ Category: Malware Tool Sale / Payload Binder ‣ Product: Universal File Binder 2026 ‣ Industry Impact: Phishing, Social Engineering, Initial Access ⠀ The tool is marketed as a payload binder, a category of malware used to attach executable code to a legitimate looking file so that opening the file triggers both the decoy document and the hidden payload. A video demo is attached to the listing and this post. ⠀ Advertised features: ⠀ ▪️ Claimed "100% FUD" (Fully Undetectable) against major antivirus engines including Windows Defender, Avast, and Kaspersky, at both scantime and runtime ▪️ Bind payloads to .jpg, .png, .pdf, .docx, .pptx, .mp4, and .mp3 files ▪️ Icon and extension spoofing, including double extension tricks ▪️ Lightweight stub with small footprint ▪️ Stated compatibility with Windows 10 and Windows 11 ⠀ Pricing: ⠀ ▪️ Single build: $100 ▪️ Lifetime access with updates: $1,000 ⠀ Binders of this type are a common component of commodity phishing kits, used primarily to deliver RATs, stealers, and ransomware via email attachments or messaging platforms. "FUD" claims on public forums are typically short lived and degrade within days or weeks of release as antivirus vendors collect samples.
1:58

‼️A malware binder tool branded "Universal File Binder 2026" is being sold on a popular cybercrime forum, advertised as fully undetectable and designed to disguise executable payloads as common file types including documents, images, and videos. ⠀ ‣ Threat Actor: Davina Keenan ‣ Category: Malware Tool Sale / Payload Binder ‣ Product: Universal File Binder 2026 ‣ Industry Impact: Phishing, Social Engineering, Initial Access ⠀ The tool is marketed as a payload binder, a category of malware used to attach executable code to a legitimate looking file so that opening the file triggers both the decoy document and the hidden payload. A video demo is attached to the listing and this post. ⠀ Advertised features: ⠀ ▪️ Claimed "100% FUD" (Fully Undetectable) against major antivirus engines including Windows Defender, Avast, and Kaspersky, at both scantime and runtime ▪️ Bind payloads to .jpg, .png, .pdf, .docx, .pptx, .mp4, and .mp3 files ▪️ Icon and extension spoofing, including double extension tricks ▪️ Lightweight stub with small footprint ▪️ Stated compatibility with Windows 10 and Windows 11 ⠀ Pricing: ⠀ ▪️ Single build: $100 ▪️ Lifetime access with updates: $1,000 ⠀ Binders of this type are a common component of commodity phishing kits, used primarily to deliver RATs, stealers, and ransomware via email attachments or messaging platforms. "FUD" claims on public forums are typically short lived and degrade within days or weeks of release as antivirus vendors collect samples.

Dark Web Informer

25,017 Aufrufe • vor 4 Monaten

Introducing our newest partner, Numen Cyber! Numen focuses on Web3 Security and Threat Detection and Response, and provide industry-leading Web3 Security Solutions, which can completely cover cybersecurity requirements of all kinds. #Partner #RedlightChain #NumenCyber $REDLC
1:02

Introducing our newest partner, Numen Cyber! Numen focuses on Web3 Security and Threat Detection and Response, and provide industry-leading Web3 Security Solutions, which can completely cover cybersecurity requirements of all kinds. #Partner #RedlightChain #NumenCyber $REDLC

Redlight Network

20,080 Aufrufe • vor 3 Jahren

Introducing the new IBM QRadar Suite - a modernized #security suite designed to speed threat detection and response. Explore how the new unified analyst experience and enterprise-grade #AI and automation can help increase security analyst productivity:
0:32

Introducing the new IBM QRadar Suite - a modernized #security suite designed to speed threat detection and response. Explore how the new unified analyst experience and enterprise-grade #AI and automation can help increase security analyst productivity:

IBM Security

23,797 Aufrufe • vor 3 Jahren

‼️ A threat actor is allegedly selling a PDF Exploit Builder advertised as 100% FUD with unlimited builds on a popular cybercrime forum, with tiered licenses starting at $300. ⠀ ‣ Threat Actor: TheStrain ‣ Category: Illicit Service / Malware Builder ‣ Victim: Adobe Acrobat Reader, Foxit Reader (delivery vector) ‣ Industry: Malware / Exploit Tooling ⠀ The actor pitches the builder as reliable, effective, FUD, and stable, capable of bundling EXE and JAR payloads inside weaponized PDF files. They claim it supports all versions of Adobe Acrobat Reader and Foxit Reader and bypasses all forms of security. ⠀ What's offered: ⠀ ▪️ Unlimited builds ▪️ EXE and JAR payload support ▪️ Compatibility with all versions of Adobe Acrobat Reader and Foxit Reader ▪️ Claimed bypass of all forms of security ▪️ 100% FUD claim ⠀ Pricing: ⠀ ▪️ 1 Month License: $300 ▪️ 3 Months License: $500 ▪️ Lifetime License: $1,500
6:23

‼️ A threat actor is allegedly selling a PDF Exploit Builder advertised as 100% FUD with unlimited builds on a popular cybercrime forum, with tiered licenses starting at $300. ⠀ ‣ Threat Actor: TheStrain ‣ Category: Illicit Service / Malware Builder ‣ Victim: Adobe Acrobat Reader, Foxit Reader (delivery vector) ‣ Industry: Malware / Exploit Tooling ⠀ The actor pitches the builder as reliable, effective, FUD, and stable, capable of bundling EXE and JAR payloads inside weaponized PDF files. They claim it supports all versions of Adobe Acrobat Reader and Foxit Reader and bypasses all forms of security. ⠀ What's offered: ⠀ ▪️ Unlimited builds ▪️ EXE and JAR payload support ▪️ Compatibility with all versions of Adobe Acrobat Reader and Foxit Reader ▪️ Claimed bypass of all forms of security ▪️ 100% FUD claim ⠀ Pricing: ⠀ ▪️ 1 Month License: $300 ▪️ 3 Months License: $500 ▪️ Lifetime License: $1,500

Dark Web Informer

47,108 Aufrufe • vor 4 Monaten

‼️ A threat actor is advertising a “ClickFix” payload delivery method that allegedly stores malware within browser cache to evade detection and bypass EDR, claiming it avoids suspicious web requests and executes via disguised commands in File Explorer. The offer includes source code, a builder, setup instructions, and a template (priced at $300), with optional custom template rewrites for an additional $200.
0:35

‼️ A threat actor is advertising a “ClickFix” payload delivery method that allegedly stores malware within browser cache to evade detection and bypass EDR, claiming it avoids suspicious web requests and executes via disguised commands in File Explorer. The offer includes source code, a builder, setup instructions, and a template (priced at $300), with optional custom template rewrites for an additional $200.

Dark Web Informer

23,376 Aufrufe • vor 7 Monaten

.Elon Musk is a national and global security threat Robert F. Kennedy Jr is a national and global security threat Tulsi Gabbard 🌺 is a national and global security threat Pete Hegseth is a national and global security threat Donald J. Trump is a national and global security threat
9:49

.Elon Musk is a national and global security threat Robert F. Kennedy Jr is a national and global security threat Tulsi Gabbard 🌺 is a national and global security threat Pete Hegseth is a national and global security threat Donald J. Trump is a national and global security threat

Andrew—#IAmTheResistance

189,605 Aufrufe • vor 1 Jahr

🚨 THREAT INTELLIGENCE ALERT 🚨 The tool 🇨🇳 KernelGhost820 is being actively sold on the underground market for US$ 2,500, complete with full source code. This is a professional-grade suite with an intuitive graphical interface and six advanced modules, specifically designed for EDR evasion and sophisticated ransomware operations with efficient lateral movement: • EDR Removal Engine: Automatically detects and terminates more than 40 security products (including CrowdStrike, SentinelOne, Microsoft Defender, Kaspersky, and others). Supports Kernel, UserMode, and NTDLL termination modes, kernel driver loading for protected processes, disabling Windows Defender, and blocking telemetry connections. • Ransomware Module: Dual encryption using AES256CBC + RSA2048, supporting over 70 file types (documents, images, databases, backups, etc.). Automatically deletes Volume Shadow Copies to prevent recovery, generates custom ransom notes with Bitcoin addresses and contact emails, and changes the desktop wallpaper. • Remote Operations & Mass Deployment: Connects to remote devices on the local network via WMI (requires username and password). Scans installed software on target hosts, performs process termination, and enables one-click full tool deployment. Includes full-network scanning for open SMB port 445 with real-time progress tracking. • Detailed Process Manager and full Operation Logger (exportable to TXT). This tool significantly lowers the technical barrier for advanced ransomware actors targeting corporate environments. Immediate monitoring recommendations: • Evaluate the resilience of your EDR/XDR controls against kernel-mode bypass techniques • Intensify monitoring of anomalous SMB (port 445) traffic and WMI connections • Strengthen network segmentation and the principle of least privilege Our team is actively tracking this tool and any emerging variants. #ThreatIntelligence #Ransomware #EDRBypass #CyberSecurity #InfoSec #CyberThreat
3:20

🚨 THREAT INTELLIGENCE ALERT 🚨 The tool 🇨🇳 KernelGhost820 is being actively sold on the underground market for US$ 2,500, complete with full source code. This is a professional-grade suite with an intuitive graphical interface and six advanced modules, specifically designed for EDR evasion and sophisticated ransomware operations with efficient lateral movement: • EDR Removal Engine: Automatically detects and terminates more than 40 security products (including CrowdStrike, SentinelOne, Microsoft Defender, Kaspersky, and others). Supports Kernel, UserMode, and NTDLL termination modes, kernel driver loading for protected processes, disabling Windows Defender, and blocking telemetry connections. • Ransomware Module: Dual encryption using AES256CBC + RSA2048, supporting over 70 file types (documents, images, databases, backups, etc.). Automatically deletes Volume Shadow Copies to prevent recovery, generates custom ransom notes with Bitcoin addresses and contact emails, and changes the desktop wallpaper. • Remote Operations & Mass Deployment: Connects to remote devices on the local network via WMI (requires username and password). Scans installed software on target hosts, performs process termination, and enables one-click full tool deployment. Includes full-network scanning for open SMB port 445 with real-time progress tracking. • Detailed Process Manager and full Operation Logger (exportable to TXT). This tool significantly lowers the technical barrier for advanced ransomware actors targeting corporate environments. Immediate monitoring recommendations: • Evaluate the resilience of your EDR/XDR controls against kernel-mode bypass techniques • Intensify monitoring of anomalous SMB (port 445) traffic and WMI connections • Strengthen network segmentation and the principle of least privilege Our team is actively tracking this tool and any emerging variants. #ThreatIntelligence #Ransomware #EDRBypass #CyberSecurity #InfoSec #CyberThreat

Clandestine

40,816 Aufrufe • vor 4 Monaten

"KILLED By A Foreign Actor" - Ex-CIA Agent WARNS Missing Scientists Are A National Security THREAT
13:22

"KILLED By A Foreign Actor" - Ex-CIA Agent WARNS Missing Scientists Are A National Security THREAT

PBD Podcast

30,288 Aufrufe • vor 4 Monaten

And then this follow up question on Rwanda's claims of a security threat along its border with the DRC. #sabcnews
1:34

And then this follow up question on Rwanda's claims of a security threat along its border with the DRC. #sabcnews

Sherwin Bryce-Pease

22,594 Aufrufe • vor 1 Jahr

We have built the most accessible and powerful security tool on the internet. Enter your domain and watch our agents find vulnerabilities you'd never expect. Enterprise security for EVERYONE. $20. You have no excuse.
2:02

We have built the most accessible and powerful security tool on the internet. Enter your domain and watch our agents find vulnerabilities you'd never expect. Enterprise security for EVERYONE. $20. You have no excuse.

zauth

12,620 Aufrufe • vor 5 Monaten

Security Onion is not just NSM anymore! We started in 2008 as a Network Security Monitoring platform, but we've added so many features over the years! - endpoint visibility - log management - case management - deception - MCP - AI - and more! Check it out!
2:42

Security Onion is not just NSM anymore! We started in 2008 as a Network Security Monitoring platform, but we've added so many features over the years! - endpoint visibility - log management - case management - deception - MCP - AI - and more! Check it out!

Security Onion

581,105 Aufrufe • vor 8 Monaten

“Perfect security doesn’t exist — only real threat models.” Charles Guillemet, CTO of Ledger, answers tough questions on hardware wallet security, real vulnerabilities, firmware updates, and why some products are just security theater. Featuring Bitcoin2Go, RobynHD, and Furkan Yildirim
6:29

“Perfect security doesn’t exist — only real threat models.” Charles Guillemet, CTO of Ledger, answers tough questions on hardware wallet security, real vulnerabilities, firmware updates, and why some products are just security theater. Featuring Bitcoin2Go, RobynHD, and Furkan Yildirim

Ledger

25,641 Aufrufe • vor 9 Monaten

hi threat hunters and malware analysts! I want to introduce you to my newly developed tool called "Matkap". with this tool, you can infiltrate telegram bots(malbots) associated with malware, gain access to their messages, and extract all their logs! ➡️
1:27

hi threat hunters and malware analysts! I want to introduce you to my newly developed tool called "Matkap". with this tool, you can infiltrate telegram bots(malbots) associated with malware, gain access to their messages, and extract all their logs! ➡️

0x6rss

192,192 Aufrufe • vor 1 Jahr