HRSword

Reported Context (3)

Uses Bring Your Own Vulnerable Driver (BYOVD) techniques to disable security protections, deploying tools such as DarkKill and HRSword to terminate EDR solutions. Qilin Ransomware Group Expands Cross-Platform Operations and Extortion Tactics
At the same time, attackers have also been observed running open-source tools such as dark-kill and HRSword. The commands below are traces of dark-kill usage. Instead of running in normal user mode, dark.sys is Cisco Talos Details Qilin Ransomware Tactics, from VPN Access to Network Encryption
c:\users\<user>\music\hrsword\hrsword install.bat Talos Details MedusaLocker Affiliate Using BabyLockerKZ Since 2022

CVE (2)

Malware (8)

People (6)

Threat Actors (1)

MITRE ATT&CK (45)

Vendors (1)

Products (26)

Tools (27)

Industries (11)

Countries (12)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.