EDRChoker Malware Uses QoS Throttling for Evasion

In June 2026, a new EDR evasion tool named EDRChoker was released that employs a novel 'bandwidth starvation' technique to neutralize endpoint security agents. Rather than terminating processes or using firewall rules that leave detectable logs, EDRChoker applies extreme bandwidth throttling (down to 8 bits per second) to specific security agent executables. This causes mandatory TLS handshakes to fail due to timeouts, effectively severing the agent's connection to its management server while remaining 'invisible' to traditional monitoring layers.

Technically, the tool exploits the Windows 'pacer.sys' driver, which sits below the Windows Filtering Platform (WFP) in the network stack. Because most EDR solutions monitor at the WFP layer, the throttling occurring at the NDIS layer generates no 'packet-drop' or 'packet-block' events. The tool is written in C#, leverages WMI for policy creation, and randomizes its GUIDs and policy names to evade signature-based detection.

While currently a red team research tool, its low barrier to entry—requiring only local administrator privileges and native Windows features—makes it a high-risk candidate for adoption by ransomware groups. Organizations should prioritize monitoring for anomalous QoS policy creation and PowerShell/WMI activity related to network settings.