Flashpoint published a deep technical teardown of the Qilin ransomware operation's infection chain, focused on two components: a custom Rust-language loader and a kernel-level EDR-killer driver-abuse module. The Rust loader performs reflective PE loading of the embedded ransomware payload directly in-process (avoiding classic process-injection tradecraft): it walks the embedded byte blob one DWORD at a time, allocates space on the heap, and deobfuscates each DWORD through a chain of arithmetic operations that is randomized per compiled sample, ultimately yielding a valid 'MZ' PE header in memory. Because the deobfuscation routine differs per sample, Flashpoint built an automated CPU-emulation-based unpacker that pattern-matches the unpacking routine inside each binary and reports a 100% success rate recovering the embedded configuration/payload without manual reversing per sample.

The EDR-killer component is distributed packed by the 'Shanya' packer-as-a-service (also documented independently by Sophos in December 2025 as 'Shanya', aka VX Crypt), which originally sold for $100-150 in 2024 and now commands roughly $2,000 per build. Shanya-packed binaries employ junk-code insertion, API-name hashing (a bitwise OR of each character against 0x20, i.e., case-folding-style hashing used to resolve WinAPI addresses without importing them by name), IAT hooking, pattern-scanning anti-analysis checks (including abuse of RtlDeleteFunctionTable to crash debuggers), Process-Environment-Block (PEB) abuse to stash configuration data, DLL side-loading for execution, and Vectored Exception Handler (VEH)-based control-flow obfuscation to defeat static and dynamic analysis tooling.

Once running, the EDR-killer drops two drivers: the legitimately Microsoft/vendor-signed but vulnerable TechPowerUp ThrottleStop.sys (a CPU-throttling-correction utility driver, versions including 3.0.0.0, tracked as CVE-2025-7771 / GHSA-f8p7-vvxp-hcxv / LOLDrivers entry 6e0786f5-2168-40a8-a068-e261c4eb10e7) and a second, unsigned driver that receives kill commands from the user-mode component. ThrottleStop.sys exposes two IOCTL interfaces built on an insecure MmMapIoSpace() call that grant arbitrary physical-memory read/write to any local caller. The EDR-killer uses this to build a full physical-memory map via the Windows memory-management service, recording Page Frame Number (PFN) metadata in a global structure, giving it a direct kernel read/write primitive without ever loading its own signed driver in the conventional sense.

With kernel read/write established, the malware locates the Code Integrity subsystem's callback table (SeCiCallbacks) and patches the driver-signature verification routine with a stub/dummy function, disabling Windows' built-in unsigned-driver-loading enforcement. This lets it load its unsigned kill-driver despite Driver Signature Enforcement (DSE) being nominally active. The kill-driver then enumerates the kernel's process-creation, thread-creation, image-load, and registry/minifilter notify-callback arrays; for each entry whose owning module address matches a hardcoded blacklist of security-product driver base addresses, it zeroes out the callback pointer in place, silently blinding EDR/AV telemetry for that product without unloading or crashing the driver (which would itself be detected). Separately, the malware manipulates the target security-product executable's DACL by constructing a new, empty ACL (SE_DACL_PRESENT set TRUE, zero ACEs) — deliberately distinguished in the code from a NULL DACL (everyone-full-access) — so that the EDR binary cannot be deleted or restarted by legitimate services, without needing to touch the file's contents.

Operationally, the malware performs environment checks before detonating: it queries the system locale and refuses to run in CIS countries (Russia, Belarus explicitly called out), consistent with Qilin's Russian-speaking-affiliate RaaS model. It attempts to acquire SE_PROF_SINGLE_PROCESS_PRIVILEGE, SE_DEBUG_PRIVILEGE, and SE_LOAD_DRIVER_PRIVILEGE token privileges to support the kernel-driver-loading and process-manipulation stages.

Qilin itself (tracked by other vendors as Agenda) is a Ransomware-as-a-Service operation first observed under the 'Agenda' brand around mid-2022, rebranding to 'Qilin' (a mythological Chinese creature) by September 2022. It is one of the most prolific RaaS operations tracked in 2025-2026, with roughly 1,500 claimed victims since launch and over 500 in 2026 alone (per MOXFIVE tracking), and was reported as the single most active ransomware brand by volume in an April 2026 30-day tracking window (~14% of all tracked ransomware activity). Affiliates reportedly retain 80-85% of ransom proceeds. Qilin's ransomware binary supports per-file selection between AES-256 (when AES-NI is available) and ChaCha20 (fallback) for bulk file encryption, layered with RSA-4096 for key wrapping, and drops a customized ransom note (branded 'CheckQilin' in some builds) referencing a Tor-hosted and clearweb-mirrored double-extortion leak site (observed clearweb mirror: wikileaks2.site). Reported initial-access vectors for Qilin affiliates include phishing/spear-phishing, valid-account abuse via compromised VPN credentials (including exploitation of compromised FortiGate SSL VPN appliances to pivot to failover infrastructure), and exploitation of internet-facing RMM tools and email gateways; lateral movement commonly leverages RDP, PsExec, GPO-based script deployment, Cobalt Strike for C2, and Mimikatz/browser-credential-theft for further credential harvesting. Manufacturing (~23% of victims), professional/scientific services (~18%), and wholesale trade (~10%) are the most heavily affected sectors, with a high-profile healthcare incident (Synnovis, UK, June 2024) cancelling over 6,000 hospital appointments/procedures.

The same ThrottleStop.sys BYOVD technique for AV/EDR killing (independent of Qilin) has been documented by Kaspersky/Securelist as used by a standalone 'AV Killer' tool and by Gentlemen ransomware, and by MedusaLocker operators in a Brazil-based incident analyzed in August 2025. The Shanya packer-as-a-service underlying the EDR-killer wrapper has separately been documented by Sophos as used across Akira, Qilin, Crytox, and Medusa ransomware families, as well as in ClickFix campaigns delivering CastleRAT malware, with telemetry showing samples in Tunisia, the UAE, Costa Rica, Nigeria, and Pakistan — establishing Shanya and the ThrottleStop BYOVD chain as shared, cross-group criminal tooling rather than Qilin-exclusive capability.