Tag: edr
-
Reynolds Ransomware Embeds BYOVD Driver to Disable EDR Security Tools
Cybersecurity researchers have disclosed details of an emergent ransomware family dubbed Reynolds that comes embedded with a built-in bring your own vulnerable driver (BYOVD) component for defense evasion purposes within the ransomware payload itself.BYOVD refers to an adversarial technique that abuses legitimate but flawed driver software to escalate privileges and disable Endpoint Detection First seen…
-
Reynolds Ransomware Embeds BYOVD Driver to Disable EDR Security Tools
Cybersecurity researchers have disclosed details of an emergent ransomware family dubbed Reynolds that comes embedded with a built-in bring your own vulnerable driver (BYOVD) component for defense evasion purposes within the ransomware payload itself.BYOVD refers to an adversarial technique that abuses legitimate but flawed driver software to escalate privileges and disable Endpoint Detection First seen…
-
EDR, Email, and SASE Miss This Entire Class of Browser Attacks
Many modern attacks happen entirely inside the browser, leaving little evidence for traditional security tools. Keep Aware shows why EDR, email, and SASE miss browser-only attacks and how visibility changes prevention. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/edr-email-and-sase-miss-this-entire-class-of-browser-attacks/
-
Zscaler extends zero-trust security to browsers with SquareX acquisition
Tags: access, ai, ceo, ciso, control, crowdstrike, cybersecurity, edr, endpoint, least-privilege, network, risk, service, strategy, tool, vpn, zero-trustA win-win for customers?: Zscaler has acknowledged that browser runtime behaviour was a missing piece in its zero-trust security, and having SquareX solution in its portfolio can help fill the gap, noted Gogia.For Zscaler customers, this acquisition would mean browser security is no longer an afterthought or a separate tool to evaluate but a native…
-
EnCase Driver Weaponized as EDR Killers Persist
The forensic tool’s driver was signed with a digital certificate that expired years ago, but major security gaps allowed Windows to load it. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/encase-driver-weaponized-edr-killers-persist
-
Attackers exploit decade”‘old Windows driver flaw to shut down modern EDR defenses
The kill list excluded Huntress: The EDR killer binary used in the Huntress-observed attack packed a 64-bit Windows executable and a custom encoded kernel driver payload, which it decoded into OemHwUpd.sys and installed as a kernel-mode service. Because Windows still honors its cryptographic signature, the attackers were able to load the driver.Once the vulnerable driver…
-
Why a decade-old EnCase driver still works as an EDR killer
Attackers are leaning on a new EDR killer malware that can shut down 59 widely used endpoint security products by misusing a kernel driver that once shipped with Guidance … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/05/edr-killer-vulnerable-encase-driver/
-
Microsoft develops a new scanner to detect hidden backdoors in LLMs
Effectiveness of the scanner: Microsoft said the scanner does not require retraining models or prior knowledge of backdoor behavior and operates using forward passes only, avoiding gradient calculations or backpropagation to keep computing costs low.The company also said it works with most causal, GPT-style language models and can be used across a wide range of…
-
EDR killer tool uses signed kernel driver from forensic software
Hackers are abusing a legitimate but long-revoked EnCase kernel driver in an EDR killer that can detect 59 security tools in attempts to deactivate them. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/edr-killer-tool-uses-signed-kernel-driver-from-forensic-software/
-
Interlock Ransomware Exploits Zero-Day in Gaming Anti-Cheat Driver to Disable EDR, AV
Interlock ransomware operators have been observed using a new process”‘killing tool that abuses a zero”‘day flaw in a gaming anti”‘cheat kernel driver to try to shut down endpoint defenses (EDR/AV). The activity was documented during an intrusion against a North Americabased education organization and shows Interlock continuing to evolve its internal tooling rather than relying…
-
Notepad++ infrastructure hijacked by Chinese APT in sophisticated supply chain attack
Rapid7 identifies custom malware: Cybersecurity firm Rapid7 also published a detailed technical analysis corroborating Ho’s disclosure and identifying the attack as part of a broader campaign deploying previously undocumented malware. Rapid7’s investigation uncovered a custom backdoor the firm dubbed “Chrysalis,” alongside Cobalt Strike and Metasploit frameworks.”Forensic analysis conducted by the MDR team suggests that the…
-
Swarmer Tool Abuses Windows Registry to Evade Detection and Persist on Systems
Swarmer, a sophisticated tool designed to manipulate Windows registry hives while bypassing endpoint detection systems. The tool exploits legacy Windows infrastructure to achieve persistent access without triggering traditional EDR monitoring systems that typically flag direct registry modifications. Endpoint Detection and Response (EDR) solutions have significantly hardened defenses against conventional registry persistence techniques. Classic methods using…
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 81
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter UNO reverse card: stealing cookies from cookie stealers PDFSIDER Malware Exploitation of DLL Side-Loading for AV and EDR Evasion VoidLink: Evidence That the Era of Advanced AI-Generated Malware Has Begun PyPI Package Impersonates […]…
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 81
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter UNO reverse card: stealing cookies from cookie stealers PDFSIDER Malware Exploitation of DLL Side-Loading for AV and EDR Evasion VoidLink: Evidence That the Era of Advanced AI-Generated Malware Has Begun PyPI Package Impersonates […]…
-
Thales named Growth Index leader in Frost Radar: Data Security Platforms Report
Tags: access, ai, business, cloud, compliance, container, control, data, defense, detection, edr, encryption, endpoint, governance, identity, intelligence, LLM, monitoring, risk, saas, service, siem, soc, technology, toolThales named Growth Index leader in Frost Radar: Data Security Platforms Report madhav Tue, 01/20/2026 – 04:29 Data has always been the backbone of enterprise operations, but the rise of cloud, big data, and GenAI has multiplied its value and, with it, the motivation for attackers. In parallel, regulatory expectations are increasing and evolving. The…
-
PDFSIDER Malware Actively Exploited to Evade Antivirus and EDR Defenses
Security researchers have identified a sophisticated backdoor malware variant, PDFSIDER, that leverages DLL side-loading to evade endpoint detection and response (EDR) systems. The threat demonstrates advanced persistent threat (APT) tradecraft, combining evasion mechanisms with encrypted command-and-control capabilities to maintain covert access on compromised systems. PDFSIDER’s infection chain originates through spear-phishing campaigns delivering ZIP archives containing…
-
PDFSIDER Malware – Exploitation of DLL Side-Loading for AV and EDR Evasion
First seen on resecurity.com Jump to article: www.resecurity.com/blog/article/pdfsider-malware-exploitation-of-dll-side-loading-for-av-and-edr-evasion
-
EDRStartupHinder: Blocks Antivirus EDR at Windows 11 25H2 Startup (Defender Included)
A cybersecurity researcher has unveiled EDRStartupHinder, a proof-of-concept tool that prevents antivirus and endpoint detection and response (EDR) solutions from launching during Windows startup, including Microsoft Defender on Windows 11 25H2. The technique exploits Windows Bindlink API functionality through the bindflt.sys driver to interfere with security software initialization. The tool builds on previous research into Bindlink…
-
Why FIM Add-Ons Aren’t Integrity Monitoring ( Why EDR Still Isn’t Enough)
<div cla If you are running a strong EDR platform, you’re doing something right. EDR is essential. It’s great at detecting and responding to malicious activity: suspicious processes, behaviors, lateral movement, and indicators of compromise. But here’s the uncomfortable truth: EDR does not tell you, with certainty, whether your systems are still in a known and…
-
Cybersecurity Awareness: Why Centralized Monitoring Is No Longer Optional
In today’s digital world, cybersecurity is no longer just an IT problem, it is a business survival requirement. Organizations are deploying multiple tools such as firewalls, EDR, databases, operating systems, cloud platforms, WAFs, proxies, and more. However, simply deploying tools does not guarantee security. What truly matters is how effectively you monitor, correlate, and respond…
-
From tech sprawl to clarity with XDR
For organizations struggling with tech sprawl or alert fatigue, Cortex XDR offers a way to automate detection and response and adopt a more consolidated approach to endpoint security — without the wholesale replacement of your tech stack. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/spons/from-tech-sprawl-to-clarity-with-xdr/808081/
-
Cisco XDR in 30: Turning Security Signals Into Confident Action
How network-led Cisco XDR helps teams see threats clearly and respond faster First seen on theregister.com Jump to article: www.theregister.com/2026/01/02/cisco-xdr-in-30/
-
NtKiller Malware Advertised on Dark Web With Claims of Antivirus and EDR Bypass
A new and sophisticated defensive evasion tool dubbed >>NtKillerAlphaGhoul.
-
2025 Year in Review at Cloud Security Podcast by Google
Tags: 2fa, ai, automation, breach, cloud, compliance, computing, control, cybersecurity, data, defense, detection, edr, finance, google, hacking, incident response, infrastructure, linux, mandiant, metric, mitigation, offense, phone, privacy, risk, security-incident, siem, soc, technology, threat, vulnerability, vulnerability-management, zero-trust(written jointly with Tim Peacock) Five years. It’s enough time to fully launch a cloud migration, deploy a new SIEM, or”Š”, “Šif you’re a very large enterprise”Š”, “Šjust start thinking about doing the first two. It’s also how long Tim and I have been subjecting the world to our thoughts on Cloud Security Podcast by Google. We…
-
Singularity Linux Kernel Rootkit with klogctl Detection Evasion
Singularity, a stealth-focused Linux Kernel Module (LKM) rootkit targeting modern 6.x kernels, has added a powerful log”evasion capability that prevents its detection through traditional kernel logging interfaces such as klogctl. Designed as a “final boss” rootkit for defenders, Singularity notes deep kernel hooking, advanced log sanitization, and EDR evasion techniques to stay invisible on compromised systems.…
-
Moonwalk++ Bypasses EDR by Spoofing Windows Call Stacks
A new Moonwalk++ proof-of-concept (PoC) shows how malware can spoof Windows call stacks while staying encrypted in memory, bypassing modern EDR detection. The research highlights blind spots in stack-based telemetry increasingly relied on by enterprise defenders. “Public detection tools fail entirely to recognize the call stack tampering,” said the researcher. Moonwalk++ Shows the Limits of…