Week of March 17, 2025

Attackers used a vulnerable Checkpoint ZoneAlarm driver (vsdatant.sys) in a Bring Your Own Vulnerable Driver (BYOVD) attack to gain kernel-level privileges, bypass Windows Memory Integrity, and disable endpoint security. The driver's valid digital signature allowed it to evade detection by EDR solutions. The attack enabled persistent RDP access and credential theft.

A financially motivated campaign deployed MEDUSA ransomware using a HEARTCRYPT-packed loader and the ABYSSWORKER driver, a revoked certificate-signed driver from a Chinese vendor. The driver disables EDR systems by manipulating system processes, removing security hooks, and terminating security drivers. Attackers bypassed certificate validation by disabling Windows Time Service and setting the system date to 2012.

A null pointer dereference vulnerability (CVE-2025-0121) in Palo Alto Networks Cortex XDR agent on Windows allows a low-privileged local user to crash the agent. Malware can exploit this to perform malicious activity without detection. The issue is fixed in agent versions 8.6.1, 8.5.2, and later hotfixes.

A proof-of-concept tool demonstrates techniques to remove kernel callbacks used by EDR products, bypassing their detection mechanisms. It includes a new undisclosed method that overwrites callback functions with KCFG-compliant returns to evade integrity checks. The project targets kernel notify routines, minifilter, network callout, and ETW-TI callbacks.