Packer-as-a-Service Shanya Hides Ransomware, Kills EDR

Packer-as-a-Service Shanya is the latest addition to an emerging obfuscation market that augments ransomware, according to Sophos, which published research on the packer family on 6 December 2025. Shanya acts as an EDR killer, dropping a clean driver tied to a legitimate program and a malicious unsigned kernel driver into the target environment, enabling the malicious driver to terminate and delete security processes and services.

Sophos notes the functionality has been observed in use by multiple gangs, including Akira, Medusa, Qilin, and Crytox, and mentions its involvement in bookings-style ClickFix attacks to deploy CastleRAT. The firm reports Shanya was seen across all four hemispheres in 2025, with Tunisia and the United Arab Emirates among the most affected countries.

Defenders are urged to rely on a trusted EDR, use indicators of compromise, educate users against social engineering, and ensure systems stay patched, while Dark Reading’s outreach to Sophos confirms further comment is forthcoming.