Phantom Mantis Kernel-Assisted EDR Killer Analysis

Phantom Mantis (formerly ArmCorp/TheGentlemen) and its support entity LARVA-368 have developed a sophisticated portfolio of kernel-assisted tools designed to neutralize EDR, antivirus, and remote management software. This 'killer' portfolio is provided as a service to affiliates to facilitate ransomware deployment by pinning endpoint defenses.

The technical capability is split into two tracks: an internally maintained, multifunction line (G12 and G13) that automates security product suppression, and an externally sourced Bring Your Own Vulnerable Driver (BYOVD) tool (DriverKiller) that reuses public proof-of-concept code and vulnerable third-party drivers. G13, the most advanced variant, expands beyond simple process termination into driver-load blocking, minifilter interference, and memory destruction.

This activity represents a high threat to all sectors as it targets the fundamental integrity of endpoint security agents. The use of kernel-mode primitives allows these tools to bypass standard user-mode protections and self-defense mechanisms of major security vendors.