ctipilot.ch

PhantomKiller

tool · tool:phantomkiller-edr-evasion-driver

Endpoint-detection-and-response evasion tool observed loading a kernel driver from a remote-support tool's ProgramData directory during post-exploitation of a compromised N-able N-central management server (Sophos X-Ops Counter Threat Unit, 2026-08-04).

Coverage timeline
1
first 2026-08-05 → last 2026-08-05
Peak priority
high
1 high
Sources cited
2
2 hosts
Sections touched
1
updates
Co-occurring entities
1
see Related entities below
ATT&CK techniques
8
pinned v19.1 · see below

ATT&CK techniques

8 techniques observed across 1 entry — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.1 · compare on the matrix · Navigator layer (JSON)

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-08-05/n-able-n-central-post-exploitation-rmm-tunnel-driver · ATT&CK page ↗

Persistence TA0003

T1136.002Create Account: Domain Account×1

Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the <code>net user /add /domain</code> command can be used to create a domain account.

Evidence: 2026-08-05/n-able-n-central-post-exploitation-rmm-tunnel-driver · ATT&CK page ↗

Stealth TA0005

T1036.005Masquerading: Match Legitimate Resource Name or Location×1

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

Evidence: 2026-08-05/n-able-n-central-post-exploitation-rmm-tunnel-driver · ATT&CK page ↗

Defense Impairment TA0112

T1685Disable or Modify Tools×1

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.

Evidence: 2026-08-05/n-able-n-central-post-exploitation-rmm-tunnel-driver · ATT&CK page ↗

Discovery TA0007

T1087.002Account Discovery: Domain Account×1

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.

Evidence: 2026-08-05/n-able-n-central-post-exploitation-rmm-tunnel-driver · ATT&CK page ↗

T1518.001Software Discovery: Security Software Discovery×1

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Evidence: 2026-08-05/n-able-n-central-post-exploitation-rmm-tunnel-driver · ATT&CK page ↗

Command and Control TA0011

T1219Remote Access Tools×1

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.

Evidence: 2026-08-05/n-able-n-central-post-exploitation-rmm-tunnel-driver · ATT&CK page ↗

T1572Protocol Tunneling×1

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.

Evidence: 2026-08-05/n-able-n-central-post-exploitation-rmm-tunnel-driver · ATT&CK page ↗

Story timeline

  1. 2026-08-05N-able N-central post-exploitation, unpacked: six remote-access tools pushed to managed endpoints, a Cloudflare tunnel renamed as a Microsoft updater, and an EDR-evasion driver staged from a remote-support directory
    updatesPatching N-central is not the end of it — the actor pushed six RMM tools and pivoted to domain controllers

Where this entity is cited

  • updates1

Source distribution

  • cisa.gov1 (50%)
  • sophos.com1 (50%)

Co-occurring entities

Derived — referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Entries about PhantomKiller (1)

2026-08-05 · view entry permalink →

HIGHCVE-2026-18556exploitedupdateNATOB2

N-able N-central post-exploitation, unpacked: six remote-access tools pushed to managed endpoints, a Cloudflare tunnel renamed as a Microsoft updater, and an EDR-evasion driver staged from a remote-support directory

UPDATE · originally covered CVE-2026-18556 / CVE-2026-18577 — N-able N-central: unauthenticated admin access to the RMM console, exploited in the wild, and the day-one fix was itself bypassable (2026-08-03)

Two developments turn the N-able N-central authentication bypass from a patching task into a compromise-assessment task. CISA added CVE-2026-18556 to its Known Exploited Vulnerabilities catalog on 2026-08-04, based on evidence of active exploitation (CISA, 2026-08-04). More usefully, Sophos X-Ops has published what the actor did after taking the console (Sophos X-Ops, 2026-08-04) — the original coverage described the flaw and the incomplete first fix, but not the post-exploitation chain, and that chain is what determines whether the hotfix was sufficient.

On the management server itself, the actor created a new domain account under a backup-product name, reset existing administrator credentials, and enumerated accounts, domain-administrator group membership and installed security products before moving on (Sophos X-Ops, 2026-08-04). The reconnaissance is unremarkable; the account creation and credential reset are not, because they survive the platform being patched.

The console was then used as a distribution channel. Sophos records six different remote-monitoring-and-management tools pushed from the compromised N-central console onto reachable endpoints — AnyDesk, TacticalRMM, TeamViewer, RustDesk, SimpleHelp and HopToDesk — establishing remote access that no longer depends on N-central at all (Sophos X-Ops, 2026-08-04). That is the structural point for anyone who patched and moved on: the entry point was closed, and six independent ways back in were already in place. Alongside them a Cloudflare Tunnel client was deployed and renamed to a Microsoft-update-styled filename, giving persistent outbound tunnelling that blends into ordinary update traffic by name, and a kernel driver Sophos names PhantomKiller was loaded from a remote-support tool's ProgramData directory as an endpoint-detection-evasion component — in one instance terminating the endpoint vendor's own file-scanner process. The actor then used the management server to reach a backup server, domain controllers and application servers directly (Sophos X-Ops, 2026-08-04) — an RMM platform's whole value is reach, and that reach transfers to whoever holds the console.

Hunt concepts, telemetry class first. In account-management telemetry, local and domain account creation events sourced from the N-central service-account context are the first artefact. In process-creation telemetry with parent lineage, account-enumeration and domain-trust utilities invoked by the N-central server process rather than by an interactive administrator session is a lineage anomaly no legitimate workflow produces. In software-inventory telemetry, the presence of any remote-monitoring agent an endpoint was never provisioned with is high-fidelity regardless of which product it is. In binary-integrity telemetry, a process whose filename claims a Microsoft update component but whose signature and hash do not match that publisher is the renamed tunnel client. In driver-load telemetry, a newly loaded kernel driver staged under a remote-access tool's data directory is the evasion component.

Triage: managed-service estates legitimately run remote-access tooling, and a second product can appear during a genuine tooling migration — the discriminators are whether the deployment correlates with a change record, whether it arrived through the console at a time no administrator was working, and whether the same push reached hosts outside the migration's scope. A signed remote-access binary is not itself suspicious; a signed remote-access binary that nobody in IT deployed is.

the threat actor used the compromised N-central server to access high-value endpoints such as a backup server, domain controllers, and application servers

the PhantomKiller endpoint detection and response (EDR) evasion tool loaded a driver named k.sys, which was located in C:\\ProgramData\\AnyDesk

Sophos X-Ops (Counter Threat Unit) 2026-08-04

based on evidence of active exploitation

CISA 2026-08-04
threat05 Aug 04:12Zmulti-sourceOpen finding ↗