Week of July 15, 2024

A vulnerability in Symantec Endpoint Protection (SEP) 14.3.5351 allows an attacker with code execution to bypass the client UI password protection by patching a single instruction in memory or the binary. This enables unauthorized policy import/export, configuration changes, and potential full client compromise even with Tamper Protection enabled. The issue was fixed in SEP 14.3 RU6.

Security researcher Samuel Tulach released a proof-of-concept called PwnedBoot that leverages the Windows bootloader to bypass Secure Boot. By replacing the mcupdate_.dll file and booting with Driver Signature Enforcement disabled, arbitrary code executes early in the boot process. This technique could allow attackers to load malicious payloads before the operating system initializes, undermining Secure Boot protections.

Sygnia's incident response investigation uncovered a new variant of the Demodex rootkit, attributed to the China-nexus GhostEmperor group, targeting telecommunication and government entities. The updated infection chain includes an EDR evasion technique and a reflective loader for the core implant, with compilation dating to July 2021. The malware uses LOLBins, registry persistence, and a malicious service masquerading as a legitimate Windows service.

SentinelOne reports that the Fin7 threat group has developed and sold a custom tool called AvNeutralizer (aka AuKill) that tampers with endpoint detection and response (EDR) solutions. The tool has been used by multiple ransomware gangs, including AvosLocker, MedusaLocker, BlackCat, and LockBit, since early 2023. AvNeutralizer leverages a previously unseen technique using the Windows TTD monitor driver ProcLaunchMon.sys and a hardened process explorer driver to cause a denial-of-service condition on affected security products.

Killer Ultra malware, used in Qilin ransomware attacks, terminates endpoint security tools by exploiting a vulnerable Zemana AntiLogger driver (CVE-2024-1853). It also clears Windows Event Logs and contains inactive post-exploitation capabilities. The malware targets Symantec, Microsoft Defender, and SentinelOne.