The selected five-offer EDR price audit preserves different entitlements: a per-build offer, custom work, a multiple-versus-single-buyer licence and limited slots. One 24 March listing names USD 8,000 per slot. The other amounts retain unspecified dollar denominations. These dated asking terms cannot be ranked as a common product price range.
An EDR killer is a tool intended to stop or impair endpoint security. Some ransomware intrusions use one before encryption. Many require administrator privileges, but their methods differ and an attempt can fail or trigger other alerts. If you want the basics of the product it targets, see our glossary entry on endpoint detection and response (EDR).
This piece is part of the Brandefense Cybercrime Report 2026. The wider picture, 9,203 de-duplicated leak-site claims from 177 groups, is in the ransomware chapter. Here we follow one tool: what it costs, how it is pitched, who sells it and what stops it.
- 5Selected priced offers, not a market censusSource: Dated price clauses; asking terms, no payment or effectiveness verified
- Per build3 January offer asks $550; dollar denomination unstatedSource: Dated price clauses; asking terms, no payment or effectiveness verified
- Custom work22 May offer asks $950; dollar denomination unstatedSource: Dated price clauses; asking terms, no payment or effectiveness verified
- 6 slots24 March offer asks USD 8,000 per slotSource: Dated price clauses; asking terms, no payment or effectiveness verified
How an EDR Killer Fits Into a Ransomware Intrusion
Security agents defend themselves. Even an attacker with administrator rights has to get past that self-protection, and that is the job of the killer.
ESET tracked almost 90 EDR killers used in the wild and published its analysis in March 2026. Of those, 54 abuse a vulnerable but signed driver, a method called bring your own vulnerable driver (BYOVD). Together they use 35 different drivers.
Another 15 misuse anti-rootkit or other free tools, and 7 are scripts. ESET found no public proof of concept for 24 of the BYOVD tools, so it judges that their authors wrote them from scratch.
Some killers use no driver at all. ESET names EDRSilencer, which blocks the agent’s connection to its backend, and EDR-Freeze, which makes the agent’s processes hang. In both cases the agent still looks installed.
| Category | Advertised or reported mechanism | Defensive implication |
|---|---|---|
| Driver abuse | Misuse of a signed vulnerable driver | Restrict privileged access and apply tested driver controls |
| Trusted helper abuse | Misuse of anti-rootkit or other privileged tools | Monitor unexpected helper execution and agent tampering |
| Driverless interference | Blocking agent communication or suspending processes | Correlate missing heartbeats with host and network telemetry |
These are alternative technique categories described by ESET, not successive steps in one verified intrusion. Disabling one agent does not guarantee that encryption succeeds or that other monitoring stays silent.
What follows is the commercial side. ESET says sellers offer either source code or individual builds, and that prices are usually negotiated. ESET adds that disclosed prices ran from hundreds to thousands of US dollars.
Five Priced EDR Killer Offers, as the Sellers Wrote Them
The five retained clauses preserve each offer’s date, amount and entitlement. The table compares what is offered, rather than ranking technical performance.
| First seen | Advertised object or right | Price as stated | Evidence scope |
|---|---|---|---|
| 3 Jan | AV/EDR killer build | $550 per build | Retained dated price clause |
| 18 Aug | CRPx0 standalone EDR killer offer | $550 | Edited catalogue description |
| 22 May | BYOVD build to order | $950 | Retained dated price clause |
| 7 Mar | Kernel-tool offer, multiple or single buyer | $5,000 to $100,000 | Retained dated price clause |
| 24 Mar | Kernel-tool offer, six advertised slots | USD 8,000 a slot | Retained dated price clause |
These are asking terms, not verified sales or tests of the advertised builds. Only the 24 March clause names a currency (USD); the others use a bare $ sign. Named technical research below describes mechanisms independently of these offers.
Separate Builds Can Share an Asking Amount
The 3 January price clause states $550 per build. The edited catalogue records CRPx0’s separate $550 standalone-tool offer on 18 August. A shared amount does not establish a shared seller or a shared product. Neither observation demonstrates that the build can terminate the security products a buyer uses.
Custom Work Changes the Entitlement
The 22 May clause offers a build for $950 and describes BYOVD, abuse of a vulnerable driver, as its intended technique. The seller also claims a changed build. We can identify the advertised custom-work relationship without certifying novelty, a working driver or a successful evasion chain.
Scarcity Is Part of the Advertised Contract
The 7 March clause connects its own $5,000–$100,000 asking range to multiple buyers versus a single buyer. That within-ad relationship is supported. It is a price for access rights and scarcity, not measured quality. We do not compare it numerically with another advertisement.
The 24 March clause advertises six slots at USD 8,000 each. The named currency and slot unit belong to this offer. Six advertised slots do not establish six customers, revenue or delivery.
What the Offers Actually Differentiate
The price clauses distinguish a build, custom work and restricted access rights. That is a more defensible explanation of the variation than treating a larger amount as a stronger tool. A buyer may be paying for fewer people to receive a package, while the ability to impair a particular agent remains untested.
For defenders, the advertised business model and the technical mechanism answer separate questions. ESET’s mechanism research can inform detection and hardening. These offer clauses tell us what is being promised commercially; they cannot measure control effectiveness.
A Separately Priced Build and a Programme Tool
The selected offers distinguish standalone builds and restricted access rights. A programme may instead describe a wider bundle. The Gentlemen’s terms catalogue records a prepared-target or refundable-deposit entry alternative; it does not authenticate a complete inventory delivered to a partner.
Qilin and The Gentlemen account for 2,158 of 9,203 collected claims, or 23.4%. Claim volume cannot show whether a particular advertised killer worked or caused that output. The programme contract and the technical tool should therefore be investigated on their own evidence.
The EDR Killer Beside Other Advertised Ransomware Tools
The ransomware chapter lists other tools advertised for sale. The table sets them beside the killer offers, each with its own advertised terms.
| Item | First seen | Price as stated |
|---|---|---|
| Ransomware builder with decryptor and web panel | 29 Apr | $50 |
| Selected BLACKNET-00 builder-and-injector and source-code offers; same-channel grouping, with common seller identity inferred | 20 Jun to 1 Aug | $400, then $20, then $1,000 |
| “Industrial” ransomware builder | 23 Apr | $890 |
| EDR killer, flat fee | 3 Jan and 18 Aug | $550 |
| EDR killer built to order | 22 May | $950 |
| White-label ransomware platform with victim chat and leak site | 23 Jul | $5,000 once |
| Exclusive kernel EDR killer | 7 Mar and 24 Mar | USD 8,000 a slot (24 Mar), or $5,000 to $100,000 (7 Mar) |
Prices are given as each ad states them. Only the 24 March kernel ad names a currency, USD 8,000 a slot. The other ads use a bare $ sign or the word “dollars”, so we do not convert them or rank them against each other.
The items also differ: a builder, a per-build killer, a platform and limited-buyer kernel access. The builder offers come from different channel contexts; that does not verify seller identities. We do not offer them as a market average.
How to Defend Against an EDR Killer
Many killers rely on privileged access and a way to interfere with the agent. These provide defensive opportunities, but requirements differ by tool and no fixed quiet period is established. ESET warns that blocking drivers is necessary but not enough, and that blocking too widely can break legitimate software. Talos says defenders should never rely on a single product.
- Take away the administrator rights it needsRemove local admin from daily accounts and protect the accounts that keep it.
- Switch on the vulnerable driver blocklistMicrosoft turns it on by default on Windows 11 since the 2022 update, and enforces it with memory integrity (HVCI), Smart App Control or S mode. Microsoft updates it quarterly and through monthly updates.
- Add the full list where HVCI is not possibleMicrosoft offers a larger block policy for App Control. Test it in audit mode first. A driver that is already running stays loaded until a reboot.
- Turn on the attack surface reduction rule for signed vulnerable driversThe rule “Block abuse of exploited vulnerable signed drivers” stops a driver being written to disk. It does not remove one that is already there.
- Turn on tamper protection and read its alertsIt keeps real-time protection, behavior monitoring and exclusions from being changed, and it blocks registry edits to Defender settings. In Defender, hunt for the action TamperingAttempt. With another EDR, use its own tamper protection.
- Alert when an agent goes quietDriverless tools cut the agent off from its backend or freeze it, so a missing heartbeat is the signal. Also watch for new driver services and driver loads from non-Microsoft signers.
Microsoft is open about the limits. Its driver blocklist is not guaranteed to block every vulnerable driver, because some blocks are held back to avoid breaking software. This is why the list of steps is layered rather than a single switch.
If your name or domain appears in a leak-site claim, treat the first hours as an incident. Check whether your security agents are healthy before you assume the claim is old. For monitoring of such claims, see our ransomware intelligence page, and for the model behind the ads, our glossary entry on ransomware-as-a-service.
For more on how the second-largest of these crews reaches victims, read our news post on The Gentlemen claiming 38 victims in one day.
Evidence and Scope
This article uses a separate five-offer EDR price audit (dated price clauses), one CRPx0 item from the edited 60-item ransomware catalogue and the collected relay series for 1 January–27 October 2026. Catalogue dates are first-seen dates.
The selection is not a market census; programme descriptions, advertised terms and claims are different evidence units. The catalogue is an attributed account, not a fresh authentication of every original. October is partial and 22–28 July is sampled.
A claim is one canonical group–victim pair. The 9,203-claim series excludes 190 0APT claims and removes 171 spelling-variant duplicates. A repeated relay post is not independent confirmation. Asking terms do not establish payments, delivery or tested effectiveness.
AI-Assisted Preparation
Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.
Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.
Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed.
Brandefense analysts reviewed and approved the findings.
