Hackers Advertised VOID ‘AV Killer’ with Kernel-level Termination Claims

The cybercriminal threat actor known as Crypt4You has recently emerged on underground forums and dark web marketplaces, advertising a sophisticated tool named VOID KILLER.

This malicious software operates as a kernel-level antivirus and endpoint detection response (EDR) process killer, designed to evade and neutralize security defenses.

The tool is being marketed as an alternative to traditional crypters, representing a significant shift in how cybercriminals approach defense bypass mechanisms.

By targeting the core of operating systems, VOID KILLER attempts to eliminate protective barriers that organizations rely on to detect and stop malicious activities.

The emergence of VOID KILLER highlights an escalating threat landscape where attackers are investing in advanced tools to compromise enterprise environments.

Unlike traditional malware that simply encrypts code, this kernel-level solution directly terminates security processes before they can respond to threats.

Security researchers have documented that the tool directly challenges modern defensive architectures, particularly those relying on behavioral detection and real-time monitoring capabilities.

KrakenLabs researchers and analysts identified and documented the threat after examining the tool’s advertising materials and claimed capabilities.

VOID KILLER Analysis

The analysis revealed that VOID KILLER represents a dangerous evolution in anti-detection technology, offering cybercriminals the means to operate with reduced oversight within compromised systems.

Kernel-level termination represents the most critical technical aspect of VOID KILLER’s functionality. Operating at the kernel level means the tool executes with the highest system privileges, allowing it to bypass standard user-mode protections.

According to the threat intelligence findings, VOID KILLER claims to terminate Windows Defender and approximately fifty consumer-grade antivirus solutions instantly, reportedly with zero detection at both scan and runtime stages.

The tool employs polymorphic build techniques, generating fresh file hashes with each compilation to evade signature-based detection systems.

Additionally, it incorporates automatic User Account Control (UAC) bypass mechanisms, enabling it to escalate privileges without triggering security alerts.

The payload-agnostic architecture allows operators to inject any executable file, making VOID KILLER compatible with various malware families.

Notably, the seller offers additional variants targeting enterprise solutions like CrowdStrike and SentinelOne, sold separately for enhanced market penetration.

The threat actor prices custom VOID KILLER builds at three hundred dollars per instance, accepting Bitcoin, Ethereum, Litecoin, and Monero. A demonstration video shared by Crypt4You further validates the tool’s destructive capabilities.

Organizations using Windows Defender, consumer antivirus software, and even advanced EDR solutions face heightened risk exposure.

The advent of VOID KILLER underscores the necessity for defense-in-depth strategies and kernel-level security implementations to counter emerging threats effectively.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.