Shanya Crypter Is the New Ransomware Toolkit: Uses Kernel Driver Abuse to Kill EDR

According to Sophos X‑Ops, a sophisticated new “packer-as-a-service” called Shanya (or VX Crypt) has emerged to help ransomware gangs bypass modern security protections and is already favoured by major groups such as Akira, Medusa and Qilin. First spotted on underground forums in late 2024, Shanya markets itself as a premium solution for evading antivirus detection and offers features including AMSI bypasses for .NET assemblies, UAC bypasses and anti-virtual machine capabilities.

Sophos researchers describe Shanya as using aggressive obfuscation, with loader code containing miles of junk code and a doppelganger technique that loads a second instance of a Windows system DLL and overwrites its text section.

A notable use is as an “EDR Killer”: the packer side-loads a malicious DLL alongside a legitimate executable, drops two kernel drivers (a legitimate but vulnerable ThrottleStop.sys and a malicious unsigned hlpdrv.sys), and then abuses the vulnerable driver to gain kernel‑level write access to send a kill command to the malicious driver, terminating many EDR processes before ransomware is deployed. The footprint is global, with higher infection indicators in the UAE, Chile and Italy, according to the report published on 6 December 2025.