Skip to content

ESET Research: The EDR Killer Ecosystem 2026

ESET Research has unveiled a massive shift in ransomware tactics. Attackers are increasingly using EDR Killers—specialized tools designed to blind security software—as a prerequisite for successful data encryption.

Strategic Division of Labor Affiliates pick the tools, while operators provide the encryptors. More affiliates mean more diverse and unpredictable attack methods.
The AI Influence Recent codebases, specifically from the Warlock gang, show markers of AI-assisted generation, including “trial-and-error” logic.
Driverless Neutralization BYOVD is common, but attackers now abuse legitimate anti-rootkit utilities and admin commands to suspend protection without touching the kernel.
 

The Defensive Reality

Protecting against modern ransomware requires a mindset shift. Unlike automated threats, ransomware is a human-driven operation. When a tool fails or a driver is blocked, the attacker is there in real-time to pivot to a new method.

“While preventing vulnerable drivers from loading is a crucial step, it is not a silver bullet. Defenders must aim to disrupt EDR killers before they establish a kernel-level foothold.”

For the full technical analysis, visit WeLiveSecurity.com and search for the 2026 EDR Killer Ecosystem report.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

ESET Endpoint Security v12 CC Certification

ESET, a global cybersecurity leader, has been named to the 11th annual CRN® Security 100 list. The company was specifically highlighted as one of the “20 Coolest Endpoint and Managed Security Companies of 2026” for its continuous innovation within the ESET PROTECT portfolio. These advancements assist channel partners in expanding services, maintaining regulatory compliance, and meeting cyber insurance demands.

Empowering the Channel with Advanced Security

CRN’s Security 100 list recognizes vendors that work closely with channel partners to deliver mission-critical, next-generation security solutions. Jennifer Follett, Vice President at CRN, noted that these vendors “continue to evolve their portfolios to stay ahead of adversaries and emerging threats.”

Scalable MDR and AI-Driven Automation

In 2025, ESET enhanced its ESET PROTECT MDR for MSPs to help providers manage cybersecurity complexity and industry fatigue. Key features of the service include:

  • Rapid Response: Boasts an average detection and response time of just six minutes.
  • Hybrid Intelligence: Integrates AI-powered automation with expert human threat hunting and global threat intelligence.
  • Comprehensive Monitoring: Provides 24/7 monitoring with integrated protection for endpoints, email, and cloud environments through a unified platform.

 

A 5-Star Partner Experience

In addition to the Security 100 recognition, ESET earned a 5-Star rating in the 2026 CRN Partner Program Guide. This rating reflects the maturity of the ESET Partner Connect Program, which offers:

  • Profitable Growth: Features stackable margins, incumbency protection, and a flexible tiered structure.
  • Extensive Support: Provides partners with comprehensive training, certifications, and robust sales and marketing resources.
  • Technical Edge: Equips partners with insights from ESET’s global R&D network to strengthen customer security and drive long-term success.

“Being recognized on the 2026 Security 100 list — and earning a 5-Star Partner Program rating — validates our strategy of pairing cutting-edge, AI-native security solutions with a flexible, profitable program,” said Ryan Grant, Country Manager, U.S. and Canada at ESET.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

ESET Honored on CRN 2026 Security 100 List

ESET, a global cybersecurity leader, has been named to the 11th annual CRN® Security 100 list. The company was specifically highlighted as one of the “20 Coolest Endpoint and Managed Security Companies of 2026” for its continuous innovation within the ESET PROTECT portfolio. These advancements assist channel partners in expanding services, maintaining regulatory compliance, and meeting cyber insurance demands.

Empowering the Channel with Advanced Security

CRN’s Security 100 list recognizes vendors that work closely with channel partners to deliver mission-critical, next-generation security solutions. Jennifer Follett, Vice President at CRN, noted that these vendors “continue to evolve their portfolios to stay ahead of adversaries and emerging threats.”

Scalable MDR and AI-Driven Automation

In 2025, ESET enhanced its ESET PROTECT MDR for MSPs to help providers manage cybersecurity complexity and industry fatigue. Key features of the service include:

  • Rapid Response: Boasts an average detection and response time of just six minutes.
  • Hybrid Intelligence: Integrates AI-powered automation with expert human threat hunting and global threat intelligence.
  • Comprehensive Monitoring: Provides 24/7 monitoring with integrated protection for endpoints, email, and cloud environments through a unified platform.

 

A 5-Star Partner Experience

In addition to the Security 100 recognition, ESET earned a 5-Star rating in the 2026 CRN Partner Program Guide. This rating reflects the maturity of the ESET Partner Connect Program, which offers:

  • Profitable Growth: Features stackable margins, incumbency protection, and a flexible tiered structure.
  • Extensive Support: Provides partners with comprehensive training, certifications, and robust sales and marketing resources.
  • Technical Edge: Equips partners with insights from ESET’s global R&D network to strengthen customer security and drive long-term success.

“Being recognized on the 2026 Security 100 list — and earning a 5-Star Partner Program rating — validates our strategy of pairing cutting-edge, AI-native security solutions with a flexible, profitable program,” said Ryan Grant, Country Manager, U.S. and Canada at ESET.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

ESET Uncovers “PromptSpy” – The Era of AI-Driven Android Threats

ESET researchers have discovered PromptSpy, the first known Android threat to utilize generative AI (Google Gemini) within its execution flow. By prompting an AI model to interpret UI elements, the malware achieves a level of adaptability previously unseen in mobile threats.

Technical Breakthrough: PromptSpy uses Gemini to receive dynamic instructions on how to “lock” itself in the recent apps list, ensuring the malicious process remains active and cannot be easily closed by the user.
 

Key Capabilities

Remote VNC Access
Lockscreen Data Theft
Invisible UI Overlays
Screen Activity Recording
AES-Encrypted C&C
Anti-Uninstallation Logic
 

Distribution and Targeting

The malware currently targets users in Argentina by impersonating the Morgan Chase bank (using the name MorganArg). It is distributed through malicious third-party websites and is not present on the official Google Play Store.

Critical Removal Procedure

Because PromptSpy uses invisible overlays to block uninstallation, users must follow these steps:

  1. Reboot into Safe Mode: Typically by long-pressing the “Power Off” option in the power menu.
  2. Navigate to Settings: Go to Settings → Apps.
  3. Uninstall: Locate “MorganArg” and select Uninstall.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

量化 ROI：透過治理影子 AI 降低總體持有成本 (TCO)

AI 的採用不再只是趨勢，而是一場衝刺。雖然高達 81% 的 AI 使用 發生在 IT 部門的可視範圍之外，但這種「影子 AI (Shadow AI)」現象正帶來巨大的財務風險。為了保護企業盈餘，IT 領導者必須從單純的偵測轉向以投資報酬率 (ROI) 為核心的治理模型。

$4.88M 資料外洩平均成本
$2.2M 治理帶來的平均節省
4% 潛在全球營收罰金

影子 AI 隱藏的 TCO 三大支柱

在 AI 時代，總體持有成本 (TCO) 已延伸至軟體授權之外，更包含了因使用未經審核的工具而產生的「風險持有」成本：

修復成本 修復由 AI 產生的代碼錯誤（幻覺）或清理因不安全指令 (Prompt) 導致的資料外洩所需的人力成本。
破碎的數據資產 當企業專有資訊被困在個人的大型語言模型 (LLM) 孤島中而非集中管理時，所造成的價值損失。
合規性法律責任 未能通過稽核以及違反歐盟《AI 法案》或 GDPR 等標準所帶來的財務衝擊。

治理紅利：計算 ROI

治理影子 AI 是一項避免成本 (Cost Avoidance) 的戰略。透過實施自動化安全控制，組織可以有效消除「影子稅」。根據 IBM 2024 年的報告，廣泛使用安全 AI 與自動化技術的組織，其外洩成本平均可降低 220 萬美元 —— 這是企業主動治理所獲得的直接紅利。

成本控制的財務框架 (NIST AI RMF)

應用以下四個步驟，將影子 AI 負債轉化為受管資產：

  • 治理 (Govern)： 以「安全使用政策」取代全面禁用，為員工提供一條安全的採用路徑。
  • 對照 (Map)： 利用偵測工具照亮網路中運行的所有應用程式。
  • 衡量 (Measure)： 針對高頻率使用的未授權工具進行財務與安全風險評估。
  • 管理 (Manage)： 透過單一平台集中管理存取權限，強化身分驗證控制。

結論：戰略性創新

IT 領導者擁有獨特的機會，在推動創新的同時，嚴格保護組織的財務健康。透過揭開影子 AI 的面紗，您將不再把資源消耗在隱藏風險中，而是開始投資於安全且可擴展的增長。

關於 JumpCloud

JumpCloud® 提供一個統一的開放式目錄平台，使 IT 團隊和 MSP 能夠輕鬆、安全地管理公司企業中的身份、裝置和存取權限。通過 JumpCloud，用戶能夠從任何地方安全工作，並在單一平台上管理其 Windows、Apple、Linux 和 Android 裝置。

About Version 2

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

×

Hello!

Click one of our contacts below to chat on WhatsApp

Social Chat is free, download and try it now here!

×