The Mantis Grip: Endpoint Defenses Pinned Before Encryption

Phantom Mantis combines custom-developed and publicly sourced kernel-mode tools to systematically disable endpoint security controls—including antivirus, EDR, and monitoring agents—before deploying ransomware, using both automated multifunction drivers and BYOVD techniques to ensure rapid, persistent, and flexible defense evasion.