Hotta Killer

Hotta Killer is a custom evasion and process-killing malware tool associated with the Interlock ransomware group. It is described as a Bring Your Own Vulnerable Driver (BYOVD) utility used to disable endpoint security controls before ransomware execution, particularly EDR and AV products. Multiple sources in the content state that it exploits a zero-day vulnerability in the legitimate, digitally signed gaming anti-cheat driver GameDriverx64.sys, tracked as CVE-2025-61155, which Interlock drops under the renamed filename UpdateCheckerX64.sys. The tool is implemented as a DLL identified as polers.dll and is executed via rundll32.exe; it reportedly creates a symbolic link to communicate with the driver and passes target process IDs so the driver can terminate them from kernel space, including via ZwTerminateProcess(). The content specifically notes targeting of Fortinet security software and processes matching patterns such as Forti*.exe, and cites its use against FortiEDR. Hotta Killer was reported in Interlock intrusions against education-sector organizations in the United States, United Kingdom, and a North American education victim, where it was used alongside ClickFix social engineering, MintLoader, NodeSnakeRAT, AZcopy-based data exfiltration, and subsequent ransomware deployment against Windows endpoints and Nutanix hypervisors. High-confidence indicators directly mentioned in the content include polers.dll, UpdateCheckerX64.sys, GameDriverx64.sys, CVE-2025-61155, and in one report the hashes polers.dll SHA1 3B9B2D5934F9ED1E3A000A760A6FA90422E8A555 and UpdateCheckerX64.sys SHA1 7556AE58C215B8245A43F764F0676C7A8F0FDD1A.