SIGNED SOFTWARE WEAPONIZED TO KILL ANTIVIRUS

Attackers leveraged a legitimate, digitally signed application to distribute scripts that systematically disabled security software on target systems. The exploitation highlights a critical vulnerability in endpoint defense: trusted software can be abused to bypass protections that rely on operating system privileges. The malware operated with SYSTEM-level access, the highest privilege tier on Windows systems. This enabled it to terminate antivirus processes, disable security services, and prevent their restart—leaving endpoints exposed to further compromise. The use of signed software is a common evasion technique. Digital signatures verify that code comes from a trusted publisher and hasn't been modified, allowing it to execute without triggering security warnings. By repurposing legitimate signed applications, attackers bypass signature-based detection and gain credibility with operating systems and security tools. The scale of the campaign spans multiple critical sectors. Educational institutions, utility companies, government agencies, and healthcare organizations all reported infections. The healthcare and government targets suggest either targeted activity or widespread distribution with diverse impact. The method reflects a shift in attack sophistication. Rather than deploying unsigned malware that triggers immediate alerts, adversaries are weaponizing existing trusted tools. This approach reduces detection time and increases dwell time on networks before discovery. Organizations should implement additional controls beyond antivirus software. Application whitelisting, privileged access management, and behavioral monitoring can detect when signed software performs anomalous actions like killing security processes. Endpoint Detection and Response (EDR) tools monitor process termination and service disruption, potentially catching this activity even if antivirus is disabled. The incident reinforces that trust in software signatures alone is insufficient for security. Defense-in-depth strategies incorporating multiple detection layers remain essential, particularly for high-value targets in critical infrastructure and public services.