Week of February 24, 2025

A reverse-engineered exploit used physical memory manipulation to manually map an unsigned driver into kernel space, bypassing Vanguard's protections and Windows Driver Signature Enforcement. The technique was widely used in cheat clients approximately three months ago and has since been patched by Vanguard. The repository provides a technical analysis for educational purposes, with key components removed to prevent misuse.

A new Magisk module, VBMetaDisguiser, has been released to disguise vbmeta properties and other system attributes on rooted Android devices. It aims to bypass bootloader unlock detection and other integrity checks used by security apps. The module modifies system properties without flashing, potentially evading detection mechanisms that rely on these properties.

A proof-of-concept demonstration shows evasion of Microsoft Defender by downloading malicious code into memory via PowerShell from a trusted GitHub URL, then patching AMSI and ETW to prevent scanning and logging. DNS tunneling is used for C2, and the attack proceeds without Defender alerts, while the Lumu platform detects the anomaly.

In June 2024, threat actors exploited a legacy version of the TrueSight.sys driver (v2.0.2.0) to bypass Microsoft's Vulnerable Driver Blocklist and terminate security processes. They tampered with the driver's WIN_CERTIFICATE padding area to maintain a valid signature, evading certificate verification. This allowed deployment of Gh0stRAT malware and disabling of endpoint defenses.