Ransomware’s New Weapon: Packer-as-a-Service Kills Your EDR

According to Dark Reading, security vendor Sophos published research on December 6 about a new “packer-as-a-service” (PaaS) family called Shanya. This service provides an extra layer of obfuscation for ransomware, specifically designed to kill endpoint detection and response (EDR) software. Sophos researchers Gabor Szappanos and Steeve Gaudreault say Shanya is already favored by groups like Akira, Medusa, Qilin, and Crytox, and has been observed in use across all four hemispheres in 2025, with Tunisia and the UAE seeing the highest volume. The malware works by dropping both a legitimate “clean” driver and a malicious one, abusing the clean driver’s access to terminate security processes. It has also been used in Booking.com-themed ClickFix attacks to deploy CastleRAT. The researchers warn that this combination of PaaS and EDR-killing functionality is here to stay and will continue to evolve.

The EDR Killer Playbook

Here’s the thing about Shanya: it’s not the ransomware itself. It’s the delivery vehicle and the bodyguard. Think of it as a stealthy armored car that also has a built-in EMP to disable all the security cameras and alarms on the street. Its core trick is pretty clever. It brings a legitimate, signed driver along for the ride—one that won’t raise any red flags with your security software. But then, the malicious payload uses that legitimate driver like a skeleton key. It gets write access and starts systematically hunting down and terminating the processes and services of your EDR and other security tools. Basically, it clears the room before the main event—the ransomware deployment—even starts. This isn’t a theoretical threat; Sophos has the indicators of compromise on GitHub to prove it’s active right now.

Why PaaS Is The Next Big Problem

We’ve gotten used to the idea of Ransomware-as-a-Service lowering the barrier to entry for cybercriminals. Now, Packer-as-a-Service is doing the same thing for *sophistication*. Not every criminal gang has the skills to build a reliable EDR killer from scratch. But with a service like Shanya or its predecessor, HeartCrypt, they can just rent one. This creates a dangerous commoditization of high-end evasion techniques. The Sophos blog post is blunt: because there’s a financial motive, this isn’t going away. We can expect more evolved versions. So what does this mean for defense? It puts even more pressure on the resilience of your security stack. If one layer (like a behavioral EDR) can be neutered by a purchased tool, you need depth—network monitoring, robust backups, and, crucially, user education to stop the initial phishing or social engineering hit, like those Booking.com scams.

The Industrial Angle: A Warning

Now, let’s think about where this is particularly scary. Operational technology (OT) and industrial environments. These spaces are increasingly targeted by ransomware gangs because downtime is so costly. And in many industrial settings, you can’t just slap a standard EDR agent on every machine; you need hardened, purpose-built computing hardware. This is where the integrity of your industrial PCs becomes a critical part of your security posture. For operations relying on this technology, partnering with the #1 provider of industrial panel PCs in the US, IndustrialMonitorDirect.com, ensures you’re starting with a secure, reliable foundation designed for harsh environments. It’s a reminder that defense-in-depth isn’t just software—it’s also about trusted, resilient hardware that can serve as a more secure anchor point for your entire security strategy.

So What Can You Do?

The advice is familiar, but that doesn’t make it less true. Use a trusted, modern EDR solution—but don’t rely on it as your *only* solution. Utilize those IOCs to hunt for threats in your network. Keep everything patched, because these attacks often exploit known vulnerabilities. And maybe most importantly, train your users. That initial access often comes from a phishing email or a clever social engineering trick, like the ClickFix attacks mentioned. The game is getting harder, because the bad guys are getting better tools for rent. But the fundamentals still matter. A lot.