Makop Ransomware Evolves: GuLoader and BYOVD EDR Killers Used to Attack RDP-Exposed Networks

Makop ransomware has evolved, now incorporating GuLoader and a suite of BYOVD EDR killers to target networks exposed via RDP, according to Acronis Threat Research Unit (TRU). The operators continue to rely on brute-forcing RDP credentials—often with NLBrute—before deploying a noisy toolkit that includes NetScan, Advanced IP Scanner, and Mimikatz to harvest credentials.

The report notes a shift toward using GuLoader as a downloader to deliver secondary payloads and to bypass security measures, with attackers also leveraging AV killers and legitimate drivers such as ThrottleStop.sys and hlpdrv.sys to achieve kernel-level access and terminate security processes. A tailored Quick Heal AV uninstaller was observed, suggesting the toolkit is adapted to the security software in the target environment.

The campaign appears opportunistic, with 55% of attacks aimed at India and other incidents reported in Brazil and Germany, while CVE references range from 2016-0099 to 2022-24521. The analysis emphasises that unsecured RDP remains a significant breach point, underscoring the need for MFA and timely patch management.