Week of December 4, 2023

SafeBreach researchers presented eight new process injection techniques called Pool Party at Black Hat Europe 2023. These techniques abuse Windows thread pools and worker factories to execute malicious code, achieving 100% bypass against five leading EDR products. The methods are more flexible than existing techniques and fully undetectable in tests.

A path traversal vulnerability in Arcserve UDP agent prior to version 9.2 allows unauthenticated remote attackers to upload arbitrary files to any location on the file system where the agent is installed. This can lead to remote code execution and full system compromise. A proof-of-concept exploit is publicly available, but no in-the-wild exploitation has been confirmed.