Qilin Ransomware’s EDR Killer DLL – How Attackers Are Subverting Defenses

Got a question or comment? Message us here!

Qilin ransomware is deploying a malicious DLL to disable EDR tools before encryption begins. 

In this #SOCBrief, we break down how the attack works, what to look for, and how defenders can respond. 

Support the show

Watch full episodes at youtube.com/@aliascybersecurity.
Listen on Apple Podcasts, Spotify and anywhere you get your podcasts.

Episode Transcript

SPEAKER_00 (00:02):
Good morning, good afternoon, or good evening,
whenever you may be, and welcometo another episode of the Sock
Brief.
This is your go-to podcast forstaying ahead of the
ever-evolving world ofcybersecurity threats.
I'm your host Andrew, and todaywe're going to discuss a fun
tactic that's picking up steamfrom a group that we're going to

(00:23):
be talking about a lot in thefuture, and that is the Chilan
Ransomware Group is usingmalicious DLL to disable a large
number of endpoint detection andresponse tools, also known as
EDR, before deploying theirransomware.
We'll discuss EDRs allegedlyaffected, how it works, some
real-world examples, keyindicators to hunt for, and some

(00:46):
practical steps your SOC cantake to spot and stop these
attacks before your organizationbecomes the next victim.
So let's get into it.
Well, we're going to be talkingabout them a lot, but Chilin is
one of, if not the most prolificransomware groups active right
now.
They're leading victim counts inmultiple quarters of 2025 and

(01:07):
continuing into 2026.
And researchers have recentlydiscovered that they are
deploying a specially craftedmalicious dynamic link library,
DLL.
This is a file designed todisable or impair a very large
number of EDR products beforethe ransomware payload runs.
So the malicious DLL, uhcurrently, I think what we have

(01:30):
is it's named MSIMG32.dLO.
Used by Chilan, it contains ahard-coded list of over 300 EDR
driver names.
It uses bring your ownvulnerable driver techniques to
access physical memory andterminate EDR processes at the
kernel level.
Virtually every major vendor istargeted, confirmed or strongly

(01:55):
implied in the latest Talos andTrend Micro analysis.
This would be EDRs likeMicrosoft Defender for Endpoint
or Windows Defender, CrowdStrikeFalcon, Sentinel One, Sophos,
Trend Micro, Semantic, McAfee,Kaspersky, Silance, Cyberblack,
F Secure, Hitman Pro, Webroot,Palo Alto, Cortex XDR, Elastic

(02:18):
Endpoint Security, BitNefender,ESet, and dozens more from
smaller or regional vendors.
This attack is designed to bevendor-agnostic.
It doesn't rely on one specificweakness in a single product.
It attempts to systematicallykill EDR drivers across the
board.
So this is a huge concernbecause EDR tools are most

(02:40):
commonly the last line ofdefense in a network.
If attackers can blind ordisable them early, they'll gain
a huge window to move laterally,exfiltrate data, and encrypt
systems with much less chance ofdetection.
So this tactic makes theirattacks quieter and faster.
The malicious DLL doesn't relyon custom malware for the main

(03:01):
payload.
Instead, it's using livingoff-the-land techniques and
legitimate tools after blindingthe EDR.
This helps keep their dual timelow and makes behavioral
detection much harder toidentify.
For SOCS, it meansnormal-looking processes can't
suddenly become malicious, andthe usual EDR alerts that you

(03:22):
rely on may never fire.
So for visibility into this,SOCS want to do things like tune
your EDR for anomalous DLLloading, look for unusual driver
interactions, or sudden drops inyour EDR telemetry from
endpoints.
So that'll be things like if anendpoint just shuts off or

(03:42):
checks out of the console.
That's kind of a red flag.
Look for signs of EDR tamperingsuch as missing agents, disabled
services, or unexpected processinjections.
You can also make sure you'reblocking or quarantining
high-risk behaviors at yourgateways.
That'll be things likerestricting unnecessary DLL
execution, enforcing applicationallow listing, monitoring for

(04:06):
living off-the-land binaries,use network segmentation to
limit lateral movement if aninitial foothold is gained.
We have to be proactive in ourhunting, so make sure you're
reviewing your logs regularly,looking for recent anomalous DLL
activity, unusual driver loads,or sudden drops in EDR coverage,

(04:26):
like we discussed.
You can integrate threatintelligence fees for Chi Lin
IOCs.
There are vendors likeWatchGuard and others that are
already publishing details ontheir TTPs and the specific EDR
killer DLL as well.
So go find that, get hashes,create blacklists, block lists,
whatever you need to do.
Make sure you share all thisinformation with your team.

(04:47):
Make sure your colleagues knowwhat to be on the lookout for as
well.
The bottom line here is that ChiLin's EDR killer shows attackers
are working harder to remove thealarms and defenses that us
defenders count on.
Socks that are aware andprepared for these bypass
techniques can stop theseattacks before they can become a
problem.
Closing thoughts on a call toaction here.

(05:09):
With Chilin's Rise and the newEDR disabling tactics, it's a
reminder that ransomware groupswill continue to evolve and
adjust to our defenses.
SOCS that are on the lookout foroddities are quick on blocking
risky behaviors and keepcommunication flowing, can turn
potential disasters intocontained incidents.

(05:29):
This week, run one quick huntfor anomalous DLL activity or
EDR tampering in yourenvironment.
Make sure you're reviewing yourendpoint visibility controls and
identifying any potential gapsin coverage.
And that's a wrap for thisepisode of the SOC Brief.
Have questions or your own EDRbypass stories?
Hit us up on social media or viaour website.

(05:53):
Keep your eyes open, keepsharpening those skills, and
we'll talk soon.
As always, stay secure outthere.
Bye.