Why Ransomware Still Succeeds With EDR Installed: The Gaps You Must Close

Ransomware still succeeds with EDR installed comes down to a hard truth most businesses haven’t accepted yet: attackers don’t need to beat your EDR anymore, they can simply turn it off first. A campaign documented this year shows exactly how, disabling over 300 different EDR products with a single loader before the ransomware ever runs.

Why does ransomware still succeed with EDR installed?

Ransomware succeeds despite EDR because attackers now target the EDR agent itself before deploying payload, exploit devices that never had EDR ransomware protection in the first place, or abuse identity and cloud gaps EDR was never built to monitor. Installing EDR is a starting point, not a finish line.

EDR bypass has become a distinct, well-funded area of ransomware development, not an occasional edge case. Attackers increasingly treat disabling your security tooling as a required first step, not an obstacle to route around, since a neutralized EDR agent means the encryption phase that follows runs completely undetected. Understanding this shift, from evading detection to actively killing the detector, is the starting point for closing the real gaps covered in the rest of this article.

A current campaign: how one loader disables 300 EDR products at once

Cisco Talos and Trend Micro documented Qilin and Warlock ransomware operations in April 2026 using a malicious DLL, msimg32.dll, that terminates over 300 EDR drivers from virtually every security vendor on the market, before ransomware ever executes.

The technique works in stages: the DLL loads via side-loading through a legitimate application, decrypts its payload entirely in memory, then deploys two unsigned kernel drivers, rwdrv.sys for direct physical memory access and hlpdrv.sys to terminate EDR processes. Before the second driver loads, the malware specifically unregisters the monitoring callbacks your EDR relies on, ensuring termination proceeds without triggering the exact alerts those callbacks exist to generate. This isn’t theoretical: Qilin, the group behind this technique, is the same threat actor responsible for the Covenant Health ransomware breach disclosed in 2025, which ultimately exposed 478,188 patients’ records, including Social Security numbers and medical data, after 852 GB of files were exfiltrated. The group primarily gains initial access through stolen credentials, meaning the same identity gap covered later in this article was likely the entry point before the EDR-killing capability ever activated. If your business runs any commercial EDR product, treat this campaign as a direct, current threat, not a hypothetical one, since Talos confirmed the technique covers “almost every vendor in the market.

BYOVD went commodity, what that means for you

BYOVD, Bring Your Own Vulnerable Driver, is no longer a bespoke, sophisticated technique reserved for advanced threat actors. The same rwdrv.sys and hlpdrv.sys drivers used by Qilin have also appeared in Akira and Makop ransomware attacks, confirming this capability now circulates as shared, reusable tradecraft across multiple ransomware operations.

This shift from sophisticated to commodity matters enormously for risk planning. When a technique requires custom development, only well-resourced threat actors can deploy it. Once the tooling gets shared or sold across affiliate networks, as BYOVD clearly has, any ransomware-as-a-service affiliate can deploy the same EDR-killing capability regardless of their own technical sophistication. This means the assumption “we’re too small a target for this level of technique” no longer holds, since the barrier to entry for defeating your EDR has collapsed to whatever it costs to access shared criminal tooling, not the cost of developing a novel exploit. The most direct defensive measure against this specific vector is Hypervisor-Protected Code Integrity, which prevents unsigned or blocklisted drivers from loading at the hypervisor level even if an attacker gains local access, a control worth confirming is enabled across your fleet given how widely this technique has now spread. Beyond that single control, Cisco Talos specifically recommends centralized logging through a SIEM and network behavioral monitoring as independent safety nets, since these retain value even in the exact scenario where your EDR has been neutralized.

The gap most narratives miss: where EDR was never deployed at all

A significant share of ransomware incidents succeed not because EDR was defeated, but because it was never installed on the device that got compromised first, a genuinely common gap in environments with cached credentials or unmanaged devices, sometimes affecting more than a quarter of an organization’s total device footprint.

This gap concentrates specifically around personal devices, BYOD laptops and phones, legacy systems that can’t run modern agents, and IT-unmanaged endpoints that connect to corporate resources without ever going through a formal device enrollment process. Each unmonitored connection represents a genuine security gap, since an attacker landing on one of these devices operates with the same visibility blind spot whether your EDR technology is world-class or entirely absent, because it simply isn’t watching that specific device at all. A business owner recognizes this scenario immediately: a contractor’s personal laptop connects to your shared drive, gets compromised through an unrelated phishing email, and the resulting lateral movement into your actual network happens entirely outside any tool you’re paying for. Auditing which devices genuinely have active EDR coverage, not just which devices your policy says should have it, is frequently the single highest-value gap-closing exercise available before investing in more advanced detection capability elsewhere.

Cloud and identity control-plane abuse hiding in plain sight

EDR was built to monitor endpoints, processes, files, memory, not cloud control planes or identity systems, meaning attackers who pivot into cloud administration consoles or abuse legitimate identity credentials often operate entirely outside what any endpoint agent can see, regardless of how well-tuned it is.

This represents a genuine architectural blind spot, not a configuration failure. An attacker who compromises cloud administrator credentials and modifies storage permissions, disables backup jobs, or provisions new infrastructure through a cloud console never touches a monitored endpoint process at all, leaving EDR with nothing to flag. Ransomware operators increasingly target this layer specifically because it sits outside endpoint-focused detection entirely, and Qilin’s own reliance on stolen credentials for initial access, covered earlier, shows this identity-first approach is already standard practice for major ransomware operations, not an emerging edge case.

How do you know your controls work? Breach and Attack Simulation

Breach and Attack Simulation, or BAS, continuously runs real attacker techniques mapped to the MITRE ATT&CK framework against your live security controls, providing actual evidence of whether they detect and block real behavior, rather than the assumption that a deployed tool is a working one.

This distinction matters directly given everything covered above: a business can have EDR installed, properly licensed, and showing green on a dashboard while the specific behavioral detection rule that would have caught the Qilin technique sits silently disabled through misconfiguration. BAS platforms, including named tools like SafeBreach, AttackIQ, Picus Security, and Cymulate, run continuous, safe simulations against production controls, testing endpoint, email, network, and cloud defenses on an ongoing basis rather than relying on an annual penetration test that’s stale within weeks. Worth noting honestly: BAS validates whether individual controls catch known techniques, it doesn’t necessarily chain multiple weaknesses into a full exploitable attack path the way dedicated penetration testing does, so treat it as continuous control validation, not a complete replacement for periodic deeper testing.

Why “green” on your compliance dashboard doesn’t mean you’re protected

A dashboard showing EDR as “deployed” or a compliance checklist marked complete reflects presence, not effectiveness, and current research shows this gap is genuinely widespread: 97% of security practitioners reported a confirmed breach or near-miss in the past year specifically caused by a misconfigured, not missing, security tool.

This statistic deserves particular weight because it directly undermines the assumption most compliance frameworks quietly encourage: that having a tool checked off satisfies the underlying security requirement. A commonly cited example is disabled EDR behavioral analytics, the specific detection capability that would catch exactly the kind of process termination and kernel driver abuse the Qilin campaign relies on, quietly turned off or under-scoped without anyone noticing until an incident reveals the gap. The practical fix isn’t more tools, it’s periodic, specific verification that the behavioral analytics, callback monitoring, and tamper protection features your EDR license includes are actually enabled and functioning, not just installed. Treat any compliance checkmark for “EDR deployed” as the start of a verification conversation, not the end of one.

Closing the identity-layer gap: ISPM alongside your EDR

ISPM, Identity Security Posture Management, continuously discovers and remediates identity risk, over-privileged accounts, dormant credentials, misconfigured access, closing exactly the gap that lets stolen-credential-based ransomware operators like Qilin gain initial access before your EDR ever gets a chance to detect anything at the endpoint.

Since EDR operates at the endpoint layer and ransomware groups increasingly gain entry through stolen credentials rather than endpoint exploitation, pairing EDR with ISPM addresses two genuinely different parts of the same attack chain: ISPM reduces the chance a stolen credential grants meaningful access in the first place, while EDR remains your detection layer for what happens on the device itself once an attacker is inside. Businesses treating identity security and endpoint security as separate, unrelated budget lines are missing that modern ransomware operations, Qilin explicitly included, chain both together deliberately, credential theft for entry, EDR-killing tooling for evasion, and neither layer alone closes the full path.

A realistic plan if you have legacy or specialist devices that can’t run an agent

For devices that genuinely can’t run a modern EDR agent, legacy medical equipment, specialized industrial systems, older operating systems, compensate with network segmentation isolating them from your main environment, and route their traffic through monitored network chokepoints where behavioral analysis can happen outside the device itself.

This isn’t a full substitute for endpoint visibility, but it’s a genuine, achievable mitigation for the devices where an agent simply isn’t an option. Segment these devices onto a separate network zone with tightly controlled, logged access points, ensuring any lateral movement attempt toward them or from them passes through a monitored boundary rather than moving invisibly across a flat network. Cyber Security Solutions Ltd works with clients managing exactly this kind of mixed environment, modern EDR-covered systems alongside legacy equipment that can’t support an agent, and network-level compensating controls consistently close the largest share of that specific gap without requiring a full infrastructure replacement.

Conclusion

Why ransomware still succeeds with EDR installed comes down to gaps most businesses haven’t tested for: an EDR-killing loader, unmanaged devices, misconfigured detection, and identity paths EDR was never built to watch. Verify your controls actually work, don’t assume they do because they’re installed. If you want help auditing your EDR configuration or identity exposure against current threats, Cyber Security Solutions Ltd can walk through it with you at cybersecuritysolutionsltd.com.