The ransomware landscape continues to evolve with increasingly sophisticated tooling, and the threat group Phantom Mantis, formerly known as ArmCorp, has emerged as a significant player by offering affiliates more than just ransomware payloads.
Operating under a partnership program branded as “The Gentlemen,” the group now provides a dedicated support service known as LARVA-368, which supplies customized endpoint detection and response (EDR) bypass tools tailored to the security products encountered during intrusions.
This service-oriented approach represents a growing trend in the ransomware-as-a-service (RaaS) ecosystem, where affiliates receive enterprise-like support that lowers the technical barrier for launching highly effective cyberattacks.
Phantom Mantis Deploys Kernel-Level EDR Killers
Unlike traditional ransomware operations that require affiliates to develop or acquire their own defense-evasion tools, Phantom Mantis centrally develops, maintains, and distributes specialized software capable of disabling security products across diverse enterprise environments.
By outsourcing this critical stage of the attack chain, the operators enable affiliates to focus on gaining initial access and deploying ransomware while relying on professionally maintained kernel-level utilities to neutralize defensive technologies.
This significantly increases the effectiveness and scalability of ransomware campaigns targeting organizations worldwide.
Security researchers have identified three primary tools within Phantom Mantis’ current arsenal: G12, G13, and DriverKiller, a Bring Your Own Vulnerable Driver (BYOVD)-style utility.
Unlike conventional malware that attempts to terminate antivirus or EDR software from user mode, these tools shift critical operations into the Windows kernel.
Operating at kernel level enables them to bypass many self-protection mechanisms implemented by modern security solutions, allowing them to interfere with protected services that would normally resist termination attempts.
This architectural advantage makes the tools particularly dangerous in enterprise environments where advanced endpoint security products are deployed.
The G12 and G13 frameworks function as automated loaders that decode embedded malicious drivers, register them as kernel services, and continuously monitor the operating system for approximately 180 security, monitoring, and remote management processes.
Their target list includes products from major vendors such as Microsoft, CrowdStrike, SentinelOne, Sophos, Elastic, Bitdefender, Kaspersky, ESET, as well as numerous remote monitoring and vulnerability assessment solutions.
When a protected process is detected, the loader communicates with the kernel driver through IOCTL 0x22201C, instructing it to obtain termination privileges and invoke the Windows kernel function ZwTerminateProcess to forcibly shut down the targeted security software.
Researchers also discovered that both frameworks employ lightweight obfuscation techniques to complicate analysis. The embedded kernel drivers are encrypted using a single-byte XOR key (0xAB) before being decoded during execution.
G12 deploys its driver as drv.sys under a kernel service named drvsvc, while G13 installs anticheatG13.sys into the Windows temporary directory using the abbreviated service name “a”, helping the malware blend into legitimate system activity.
Beyond simple process termination, the malicious drivers expose a much broader collection of kernel-level capabilities. They include process protection filters, Windows Filtering Platform (WFP) traffic manipulation, command-line rewriting, file system operations, and process image-path spoofing, enabling attackers to interfere with defensive software at multiple levels.
These features allow affiliates to disable, manipulate, or evade security controls even when products implement hardened or protected execution environments.
The more advanced G13 framework extends these capabilities by actively inspecting newly loaded kernel drivers before they initialize.
It evaluates drivers using CRC32 hashes, byte-signature matching, whitelist validation, and even checks for VMProtect markers.
If a targeted defensive driver matches predefined indicators, G13 modifies the driver’s entry point to immediately return STATUS_ACCESS_DENIED, effectively preventing the security component from loading.
This preemptive defense-neutralization strategy gives attackers a significant advantage before endpoint protection software becomes fully operational.
G13 also introduces destructive memory manipulation capabilities. Instead of relying solely on process termination, it can attach to running processes, identify writable memory regions, and overwrite them with repeated byte patterns such as 0xCC, causing applications to crash or malfunction while avoiding traditional termination events that security tools may monitor.
Additional features include cross-process memory transfers through MmCopyVirtualMemory, enumeration and deregistration of Windows minifilter drivers, and encrypted logging using XOR-obfuscated log files stored under dynamically generated WindowsData-derived filenames.
The emergence of Phantom Mantis’ affiliate support model demonstrates the continued professionalization of ransomware operations.
By delivering kernel-level EDR bypass tools as a managed service, the group dramatically reduces the technical expertise required for affiliates to compromise well-defended organizations.
Security teams should prioritize driver integrity monitoring, enable virtualization-based security and Microsoft Defender Application Control where possible, restrict unauthorized driver loading, monitor kernel service creation events, and deploy behavioral detection capable of identifying suspicious IOCTL activity and privileged process manipulation.
As ransomware operators continue investing in sophisticated kernel-level offensive capabilities, organizations must strengthen both endpoint protection and proactive threat hunting to counter increasingly advanced attacks.
No Comment! Be the first one.