Medusa Ransomware Strikes with Lethal EDR-Disabling Driver Attack

By Frank Jones, CISSP   Published: 03/22/25   Updated: 10/31/26   3 min read
Cyber News

Medusa Ransomware Strikes with Lethal EDR-Disabling Driver Attack

Summary

Introduction: A New Wave of Cyber Threat

Medusa ransomware operators have added a way to switch off one of the main defenses most companies rely on: endpoint detection and response (EDR) software. Their method is a malicious kernel driver that runs with the highest privileges on Windows and attacks the security tools directly.

The Malicious Driver: An EDR Killer

Elastic Security Labs described the driver on March 20, 2025 and named it ABYSSWORKER. In the campaign it tracked, a loader packed with the HeartCrypt service installs a driver called smuol.sys, which pretends to be a CrowdStrike Falcon driver. It is signed. The samples carry likely stolen, revoked certificates from Chinese companies, and once loaded, the driver can kill processes, delete files and strip out the callbacks EDR products rely on to see what is happening on a machine. ConnectWise had reported the same driver earlier, in a different campaign. With the EDR blinded, the attackers can steal data and launch the encryptor with much less risk of an alert. Companies that treat EDR as their main line of defense lose most of their visibility at the moment they need it.

Understanding the Implications for Businesses

For defenders, the lesson is plain. A single security tool can be turned off. If attackers already have administrator rights and can load a kernel driver, they can often disable endpoint protection before anyone notices. That argues for layered defenses: network monitoring, central logging that attackers cannot easily erase, and an alert whenever a security agent stops reporting. Each of these can catch an attack that has silenced EDR on individual machines.

Intelligence Sharing and Collaborative Defense

Research like Elastic’s matters because it gives other vendors the details they need to detect the driver. The report includes indicators of compromise and a description of how the driver works. A joint advisory from CISA, the FBI and MS-ISAC in March 2025 also warned about Medusa. It said the group had hit more than 300 victims, many in critical infrastructure. Sharing this kind of information lets companies in every sector check for the same signs.

Rethinking Ransomware Defense Strategies

Practical steps include enabling Microsoft’s vulnerable driver blocklist, limiting who has administrator rights, watching for new services that load kernel drivers, patching quickly and keeping offline backups. Regular penetration tests and staff training still matter too.

Assume Your Security Tools Can Be Switched Off

Medusa’s EDR killer shows how far ransomware groups will go to stay hidden. Plan for it. The fix is not a single product. It is several layers of defense, kept up to date, with someone watching for the moment one of them goes quiet and ready to act when it does.

Also worth reading: Since this incident turns on endpoint detection and containment quality, it pairs naturally with our guide to the best EDR tools in 2026.

Stay Current

Newer CyberExperts coverage on this topic

This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.

Latest Daily Brief

Friday’s brief: Apache’s HTTP/2 fix, then Check Point break-ins, a ScreenConnect add-on and a GitHub secret stealer

The fastest way to catch up on what changed after this article was published.

Read Today's Brief

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.