{
  "name": "Cisco Talos: Qilin EDR killer infection chain",
  "slug": "cisco-talos-qilin-edr-killer-infection-chain",
  "description": "Endpoint detection and response (EDR) tools are widely deployed and far more capable than traditional antivirus. As a result, attackers use EDR killers to disable or bypass them. The malicious \u201cmsimg32.dll\u201d used in Qilin ransomware attacks, which is a multi-stage infection chain targeting EDR systems. It can terminate over 300 different EDR drivers from almost every vendor in the market.",
  "published": "2026-04-02T13:23:51+00:00",
  "created_at": "2026-04-02T13:23:51+00:00",
  "modified_at": "2026-04-02T16:02:08+00:00",
  "created_at_opencti": "2026-04-02T13:23:51+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2026-04-02"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "12fcde06ddadf1b48a61b12596e6286316fd33e850687fe4153dfd9383f0a4a0"
      },
      {
        "id": "",
        "name": "7787da25451f5538766240f4a8a2846d0a589c59391e15f188aa077e8b888497"
      },
      {
        "id": "",
        "name": "16f83f056177c4ec24c7e99d01ca9d9d6713bd0497eeedb777a3ffefa99c97f0"
      },
      {
        "id": "",
        "name": "bd1f381e5a3db22e88776b7873d4d2835e9a1ec620571d2b1da0c58f81c84a56"
      }
    ]
  },
  "external_refs": [
    "https://otx.alienvault.com/pulse/69ce8a077d7ad13478a8e495",
    "https://blog.talosintelligence.com/qilin-edr-killer/"
  ]
}