Ransomware has changed a lot over the years. It’s no longer just random malware spreading across systems—it now operates more like a structured business. Attackers plan their moves carefully, study environments, and use clever techniques to stay unnoticed for as long as possible.
One of the most concerning shifts is how cybercriminals are now using legitimate IT tools against organizations. Tools like Process Hacker, PowerRun, IOBit Unlocker, and AuKill were originally designed to help system administrators troubleshoot issues or manage processes. But today, these same tools are being repurposed to disable security systems before ransomware even starts running.
The reason attackers prefer these tools is simple. First, they are trusted. Since they are digitally signed and commonly used in enterprise environments, security software often allows them to run without suspicion. Second, they provide deep system access, sometimes even at kernel level, which gives attackers powerful control. Finally, their activity blends in with normal administrative tasks, making detection extremely difficult.
This creates what security experts call a “dual-use problem.” The same tool that helps fix systems can also be used to break them—quietly and efficiently.
Why Disabling Antivirus Is a Critical Step
Before ransomware encrypts anything, attackers usually focus on removing obstacles. Antivirus and EDR solutions are the biggest barriers because they can detect suspicious behavior, block malicious files, and alert security teams.
By shutting down these protections, attackers create a silent environment. In that state, ransomware can execute without interruption, logs can be erased, and no alerts are triggered. This step is not optional—it is a deliberate and essential part of modern ransomware attacks.
How These Techniques Have Evolved
Ransomware tactics have become more advanced over time. Earlier attacks relied on simple commands to stop services. Over time, attackers started using advanced tools and kernel-level techniques. Today, many ransomware kits already include built-in modules that automatically disable antivirus systems.
This evolution shows how attackers are constantly improving speed, stealth, and efficiency.
Understanding the Ransomware Kill Chain
Most ransomware attacks follow a structured path.
It starts with initial access, often through phishing emails, stolen credentials, or remote access misuse. Once inside, attackers escalate privileges using tools like PowerRun or kernel manipulation utilities.
Next comes antivirus neutralization, where security tools are disabled. After that, attackers steal credentials using tools like Mimikatz to move across systems. They then establish persistence and clean up traces by modifying registry entries or deleting logs.
Finally, the ransomware payload is executed, encrypting files while appearing like normal system activity.
Two-Stage Abuse of Legitimate Tools
Attackers usually operate in two stages when using these tools.
In the first stage, they focus on privilege escalation and disabling antivirus systems. Tools such as IOBit Unlocker can delete antivirus files, while Process Hacker or ProcessKO can terminate security processes instantly. Registry tools like Atool_ExperModel ensure antivirus does not restart after reboot.
In the second stage, attackers move deeper. Tools like Mimikatz extract credentials, YDArk manipulates kernel behavior, and PowerRun executes ransomware with SYSTEM-level privileges. Utilities like Unlock_IT erase logs to remove evidence.
These steps ensure that by the time ransomware runs, the system is already defenseless.
| Tool | Legitimate Purpose | Attack Scenario (Malicious Use + Silent Command Line Example + Technical Flow) | Security Impact |
| 0th3r_av5.exe | Admin utility disguise | Script-driven tool iterates over Antivirus services silently, bulk-kills processes simultaneously | Neutralizes multiple Antivirus agents at once |
| HRSword | Service/driver management utility (legitimate admin tool) | Manipulates service/driver state to disable Antivirus and prevent reinstallation → example silent command: HRSword.exe /service stop “avservice” /disable → stops target service, sets ServiceStart to disabled, and updates service binary path or recovery options to prevent automatic restart | Prevents Antivirus service recovery and reinstallation; extends attacker dwell time and hinders remediation |
| YDArk | Kernel manipulation | Disables Antivirus callbacks → ydark.exe -unload Antivirusdriver.sys → Hooks PsSetCreateThreadNotifyRoutine for stealth persistence | Undermines kernel protections |
| PowerRun | Run apps as SYSTEM | Executes ransomware payload at SYSTEM level → PowerRun.exe ransomware.exe | Bypasses user-level restrictions, full privilege |
| Unlock_IT | Unlock files/registry | Deletes Antivirus logs → UnlockIT.exe /unlock HKLM\Security\AVLogs → Erases registry entries and forensic traces | Breaks log-based investigation |
| HackTool AuKill | Antivirus neutralizer | Explicitly kills Antivirus/EDR processes → Antiviruskiller.exe –kill –all | Creates blind spot for ransomware deployment |
| Mimikatz | Credential dump tool | Extracts cached admin creds → mimikatz.exe privilege::debug sekurlsa::logonpasswords → Reads LSASS memory | Enables lateral spread via stolen credentials |
| Tool | Legitimate Purpose | Attack Scenario (Malicious Use + Silent Command line Example + Technical Flow) | Security Impact |
| IOBit Unlocker | Unlock locked files | Deletes Antivirus binaries silently → IOBitUnlocker.exe /delete “C:\Program Files\AV\avp.exe” → Uses NtUnlockFile API to bypass OS locks | Prevents Antivirus from restarting or updating |
| TDSSKiller | Rootkit removal | Abused to unload Antivirus kernel drivers → tdsskiller.exe -silent -tdlfs → Blocks Antivirus kernel modules from reloading | Weakens kernel-level defence |
| Windows Kernel Explorer (WKE) | Kernel debugger | Direct driver unloading & kernel object manipulation via PsSetCreateProcessNotifyRoutine → attacker controls OS kernel | Grants full OS control |
| Atool_ExperModel | Registry/process diagnostic | Deletes Antivirus startup keys → atool.exe /regdel HKLM\SOFTWARE\AVVendor\Startup → Breaks persistence by removing scheduled tasks | Antivirus fails to auto-start after reboot |
| Process Hacker | Task manager/debugger | Terminates Antivirus processes via SeDebugPrivilege → taskkill /IM Antivirusguard.exe /F | Instantly shuts down real-time Antivirus monitoring |
| ProcessKO | Fast process termination | Terminates Antivirus services instantly → ProcessKO.exe -kill Antivirusservice.exe | Clears real-time protection in seconds |
Emerging Trends to Watch
Ransomware continues to evolve rapidly. Attackers are now using prebuilt ransomware-as-a-service kits that include antivirus killers. Kernel-level attacks are becoming more common, and multiple tools are chained together for reliability.
There is also growing use of AI to automate attack decisions, along with supply chain attacks that distribute trojanized tools. Cloud environments are becoming new targets as organizations shift to hybrid infrastructures.
Strengthening Defense Against These Threats
To defend against these attacks, organizations need a layered approach.
Monitoring process termination is important to detect unusual shutdown of security tools. Registry and file auditing can reveal tampering attempts. Behavioral analysis helps identify abnormal system-level actions.
Restricting tool usage through application control is also critical. Only approved utilities should be allowed to run. Security teams should also monitor credential access patterns and isolate infected endpoints quickly.
Strong practices like multi-factor authentication, registry monitoring, and controlled access to administrative tools can significantly reduce risk.
Conclusion
The biggest lesson here is clear. Tools that were once trusted are now being weaponized. Attackers no longer need to create complex malware when they can simply misuse legitimate utilities.
Organizations must rethink how they manage and monitor these tools. Security is no longer just about blocking malicious files—it’s about understanding behavior and controlling access.
By combining strong security solutions with strict governance, defenders can regain control and reduce the advantage attackers currently have.
Our Opinion on This Case
In our view, this shift toward abusing legitimate tools marks a major turning point in cybersecurity. It shows that attackers are no longer relying on obvious malware signatures but are instead thinking like system administrators. This makes detection much harder because the activity looks normal on the surface.
What stands out is how predictable yet effective these attack chains are. The sequence—gain access, escalate privileges, disable antivirus, steal credentials, and deploy ransomware—has become almost standardized. Despite this, many organizations still lack visibility into these stages, especially when trusted tools are involved.
We believe the real gap is not just in technology but in control and awareness. Many environments allow powerful administrative tools to run without strict monitoring. This creates an opportunity for attackers to operate freely once inside.
Another concern is the rise of automation in ransomware kits. When antivirus bypass techniques are prepackaged, even less-skilled attackers can launch advanced attacks. This lowers the barrier to entry and increases overall risk.
Ultimately, organizations need to shift from reactive security to proactive defense. Monitoring behavior, limiting tool usage, and understanding attacker techniques are no longer optional—they are essential. Without this shift, even the best security tools can be quietly turned against the systems they are meant to protect.
