Shanya EDR Killer: How AI Spots Hidden Ransomware

Most ransomware headlines focus on encryption and ransom notes. The scarier part often happens earlier: the moment your endpoint detection and response (EDR) gets blinded.

That’s why Shanya, a “packer-as-a-service” operation reported by Sophos and covered by Dark Reading, matters. It’s not “just another ransomware strain.” It’s a service that helps multiple ransomware groups hide payloads and terminate security tooling, so the ransomware can run in peace. If you’ve been betting everything on EDR telemetry, Shanya is the reminder that attackers are happy to fight the sensors first.

This post is part of our AI in Cybersecurity series, and I’ll take a clear stance: defending against packer-as-a-service isn’t primarily a signature problem anymore—it’s a behavior and resilience problem. That’s exactly where well-designed AI-driven detection can pull its weight.

Packer-as-a-service is the “malware supply chain” problem

Packer-as-a-service (PaaS) turns evasion into a commodity. Instead of each ransomware crew building their own obfuscation, they rent a proven wrapper that:

• Obscures the real payload (ransomware, RATs, loaders)
• Complicates static analysis and signature-based detection
• Often includes anti-analysis logic (sandbox checks, timing tricks)
• Can be bundled with tooling that actively disrupts defenses

The practical outcome is simple: more actors can run more sophisticated campaigns with less expertise. That’s the same scaling dynamic that made ransomware-as-a-service so effective—now applied to the “get past EDR” stage.

Why Shanya stands out

Sophos described Shanya as already being used broadly across 2025, and Dark Reading notes it’s showing up in multiple regions and across multiple gangs. That’s a hallmark of a service layer: it spreads fast because it’s not tied to one brand of ransomware.

Shanya also appears to be filling (at least partially) a role previously associated with similar offerings. Translation: attackers are shopping for what works right now, and they’ll rotate providers as defenders adapt.

Shanya’s playbook: hide the payload, then kill the guard

Shanya is described primarily as an EDR killer. The workflow matters more than any single indicator because the same pattern shows up in lots of modern intrusions.

Step 1: Bring a driver party (one “clean,” one malicious)

Based on the reporting, Shanya drops:

• A legitimate, clean driver associated with a real program
• A malicious unsigned kernel driver

The clean driver is used to avoid early alarms (it looks normal). Then the malicious component abuses that clean driver to gain capabilities like write access needed to tamper with protected processes.

This is a nasty shift in advantage: kernel-level tampering can neutralize user-mode protections, which is where many endpoint tools live or where their controls are easiest to disrupt.

Step 2: Terminate and delete security processes

Once it has the foothold, Shanya targets processes and services associated with security products for termination and deletion—effectively blinding EDR.

Here’s the operational reality I’ve seen in post-incident reviews: once telemetry is degraded, defenders lose the “movie” of what happened. You end up reconstructing an intrusion from partial logs, suspicious admin actions, and a handful of surviving artifacts. That delay is exactly what ransomware crews want.

Step 3: Let the “real” malware do its job

Sophos observed Shanya used by multiple ransomware gangs (including those named in the source article). The important point isn’t the roster. It’s that the packer and EDR-killer layer can be reused regardless of the final payload.

This is why packer-as-a-service is such a force multiplier: defenders may stop one ransomware family and still get burned by the same “pre-ransomware” chain next week.

Why traditional EDR struggles with packers (and where AI helps)

Static detection fails because the packed sample doesn’t look like the payload. That’s the whole point of packing. Meanwhile, straightforward behavioral rules can fail if:

• The attacker disables or tampers with the EDR sensor early
• The behavior is split across multiple stages and processes
• The intrusion blends into legitimate admin tooling (PowerShell, remote management, driver installs)

AI doesn’t magically “see through” obfuscation. What it can do well is connect weak signals across time and endpoints, then prioritize what’s most suspicious.

AI advantage #1: Detect the sequence, not the file

A strong approach is to model attack sequences that are uncommon in normal IT operations. Shanya-like activity can produce a recognizable chain:

1. New or unusual driver material appears on disk
2. A service is created/started to load a driver
3. Short window of process terminations tied to security tooling
4. Telemetry volume drops from the host (a key meta-signal)
5. Follow-on staging: credential access, lateral movement, encryption

AI-based behavioral analytics can score that chain even when the payload is unknown.

AI advantage #2: Cross-endpoint correlation when one endpoint goes dark

If a single endpoint’s EDR is killed, you still have other places to learn the truth:

• Identity logs (sudden token use, impossible travel patterns, new device registrations)
• Network telemetry (new SMB sessions, unusual RDP patterns, beaconing)
• Email security events (delivery + click + subsequent device anomalies)
• Server logs (file share enumeration, mass rename operations)

Modern AI-driven threat detection is often most effective outside the endpoint: it correlates what the endpoint can’t report after the sensor is impaired.

AI advantage #3: Spot “driver abuse” as an anomaly class

One of the most actionable ideas here is to treat kernel driver events as high-signal. In most enterprises, legitimate driver installs:

• Come from known publishers
• Follow patch windows and software deployment workflows
• Are rare on user endpoints

AI can learn baseline patterns for driver load/install frequency by department, device type, and region. Anything outside that baseline becomes triage-worthy.

What an AI-assisted defense looks like (practical controls)

You don’t beat Shanya by adding one more dashboard. You beat it by making EDR harder to kill, and by ensuring you can still detect and respond when it happens.

Harden the endpoint so the attacker can’t “turn off the lights”

Start with controls that reduce the chance of successful driver-based tampering:

• Driver load governance: block known abused drivers and restrict driver installation to tightly controlled workflows
• Tamper protection: enforce EDR self-protection features and require high-friction authorization to disable agents
• Least privilege on endpoints: reduce local admin, control who can install drivers/services
• Application control: allowlisting for high-risk endpoints (finance, IT admin workstations)

If you’re serious about ransomware risk reduction, treat “EDR tampering” as a top-tier incident category, not a troubleshooting ticket.

Add AI-driven detections that focus on behaviors Shanya can’t avoid

Even if binaries are packed, the attacker still has to do things that are operationally visible. High-value behavioral detections include:

• Unusual service creation tied to driver loading (sc create, new kernel service entries)
• Burst termination patterns where multiple security-related processes stop in a short window
• Sensor health anomalies (sudden drop in event volume, agent heartbeat loss)
• Credential and lateral movement patterns that follow shortly after a host goes “quiet”

The AI piece is prioritization and correlation: not every service creation is malicious, but the cluster of events is.

Use AI to reduce response time, not just raise alerts

Detection without action is theater. AI can help you respond faster by:

• Auto-grouping alerts into a single incident timeline
• Recommending containment steps (isolate host, disable account, block hash)
• Identifying “nearby” entities at risk (same user, same subnet, same remote tool)

I’m opinionated here: the best ROI for AI in cybersecurity is compressing time-to-decision during messy incidents, especially ransomware precursors.

“People also ask” answers (for teams building playbooks)

Can AI detect packed ransomware before it runs?

Yes, when AI is applied to behavioral patterns, execution chains, and anomaly detection rather than static file traits. Packing hides code, not operational reality.

If Shanya kills EDR, is detection hopeless?

No. You can still detect the intrusion via identity, network, server, and backup-system telemetry, plus sensor health monitoring that flags when endpoints suddenly stop reporting.

What’s the single most important control against EDR killers?

Preventing driver abuse and enforcing strong tamper protection are the most direct ways to stop EDR-killer techniques. After that, resilient logging and rapid containment matter most.

A ransomware reality check for late 2025: resilience beats “perfect prevention”

Shanya is a sign of where ransomware operations are heading: specialized services that handle evasion, access, and deployment as separate components. That modularity is bad news for teams relying on any one tool or any one detection method.

The better way to approach this is to assume the endpoint can be degraded and design for security resilience:

• EDR that’s harder to tamper with
• AI-driven behavioral analytics that catch the chain, not the sample
• Cross-domain telemetry so you still see the attack when one sensor goes blind
• Response playbooks that isolate fast and ask questions later

If you want to pressure-test your exposure to packer-as-a-service and EDR killers, start with a tabletop exercise: What happens in the first 30 minutes after a critical workstation stops reporting EDR telemetry? If the honest answer is “we’d notice next morning,” that’s the gap to close.

The next wave of ransomware won’t “beat” your tools with one clever trick. It’ll win by making your visibility unreliable.

If you’re exploring AI in cybersecurity to handle threats like Shanya, focus your evaluation on two things: how well the system correlates weak signals across domains, and how quickly it helps your team make containment decisions under pressure. What would it take for your SOC to act confidently in under 10 minutes?