Shanya EDR Killer Leveraged by Ransomware Groups to Clear the Way for Ransomware Infection

Recent developments in cybersecurity have highlighted the emergence of "Shanya," a sophisticated packer-as-a-service and EDR killer, significantly impacting major ransomware operations.

Shanya appeared on underground forums in late 2024 under the alias "VX Crypt." It was engineered to replace previous market leaders like HeartCrypt. The tool effectively bridges the gap between initial access and final payload deployment. It offers attackers a specialized toolkit designed to disable security monitors and ensure successful encryption.

Shanya employs advanced DLL side-loading techniques, often compromising legitimate system binaries, such as consent.exe , to mask its execution. A key tactic in its methodology is the "Bring Your Own Vulnerable Driver" (BYOVD) approach. By deploying and exploiting legitimate but vulnerable drivers, notably ThrottleStop.sys , the malware gains kernel-level privileges. This elevation allows it to bypass standard user-mode restrictions and directly attack the kernel callbacks utilized by endpoint protection platforms.

Sophos security analysts have documented Shanya’s increasing usage across global campaigns, associating it with notable ransomware families, including Akira, Medusa, and Qilin. The tool is not merely a protective packer; it functions as an offensive weapon, systematically dismantling defenses before the ransomware payload is decrypted. This dual functionality has made it prevalent in targeted attacks in regions such as the UAE and Tunisia.

Infection Dynamics and Kernel-Level Evasion

Shanya's architecture relies heavily on advanced obfuscation and anti-analysis mechanisms to evade detection. The initial loader is filled with "junk code" to hinder reverse engineering efforts. To further evade detection, the malware calls RtlDeleteFunctionTable with invalid contexts to crash debuggers. It also conceals its configuration data within the Process Environment Block (PEB), using the GdiHandleBuffer as a covert repository for API pointers.

A defining feature of Shanya is its ability to terminate processes. Once the kernel driver is active, the user-mode component scans active services against a target list, sending instructions to the kernel driver ( hlpdrv.sys ) to terminate them forcibly.

// Logic for iterating and terminating security services while (!StrStrIA (v5, v6)) { v6 = (&driver_list) [++v7]; // Iterate through target list if (!v6) goto LABEL_14; } // DeviceIoControl sends kill command to malicious driver if (!DeviceIoControl (hDevice, 0x222008u, &InBuffer, 8u, ...)) { // Trigger termination routine }

Additionally, the malware employs a "double loading" technique, loading a second instance of a system DLL like shell32.dll and overwriting its header with the decrypted payload. This integration into legitimate memory spaces exemplifies the advanced evasion tactics that make Shanya a critical threat.

Based on reporting by Cyber Security News.