DemoKiller
DemoKiller is a commercial EDR-killer malware/tool used to disable or terminate endpoint security products during ransomware intrusions, typically before encryptor deployment. ESET identified it as one of the underground-marketed EDR killers offered as a service, and noted it is also referred to as Бафомет. ESET telemetry confirmed DemoKiller use by affiliates of the Qilin, Akira, and Gentlemen ransomware gangs, and it was also observed once in a RansomHouse intrusion. In reporting on Gentlemen, ESET specifically assessed DemoKiller as affiliate-specific and excluded it from Gentlemen’s in-house tool suite, finding no ties between DemoKiller and the gang’s centrally maintained GentleKiller framework. The provided content does not include specific technical indicators, process lists, driver names, or infection vectors for DemoKiller itself beyond its role as an EDR killer and its observed use across multiple ransomware affiliate intrusions.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The threat actor advertised an EDR killer that ESET researchers later named DemoKiller. ESET telemetry confirms that DemoKiller has been used by affiliates of the Qilin, Akira, and Gentlemen gangs...
Techniques & procedures
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Privilege Escalation
1 technique
Privilege Escalation
Other
2 techniques
Other
Before launching their file-encrypting malware, cybercriminals routinely deploy specialized tools to bypass security software... Attackers are now heavily using driverless methods, custom command-line scripts, and legitimate anti-rootkit utilities to turn off security defenses.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An EDR killer observed in several intrusions but treated as affiliate-specific tooling rather than part of the Gentlemen-maintained suite.
An affiliate-specific EDR killer observed in some intrusions, but not attributed to Gentlemen’s maintained toolset.
A commercialized EDR killer marketed on underground marketplaces as a service to disable security tools.
Commercial EDR killer sold underground and used by multiple ransomware affiliates across several gangs.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.