Week of May 26, 2025

A proof-of-concept tool named Ebyte-ETW-Redirector was published on GitHub, demonstrating a method to bypass Event Tracing for Windows (ETW) by injecting a custom assembly proxy into a target process. The tool hooks ETW functions like EtwEventWrite and NtTraceEvent to redirect or suppress event logging, potentially allowing malicious activity to evade detection by security products that rely on ETW. This technique highlights a weakness in endpoint detection mechanisms that depend on ETW for telemetry.

Researchers disclosed a critical zero-click vulnerability in Microsoft 365 Copilot that allowed prompt injection via email to exfiltrate sensitive data. The flaw, tracked as CVE-2025-32711, bypassed classifiers and markdown link redaction. Microsoft patched the issue before public disclosure, with no known exploitation.

Vulnhuntr is an open-source tool that uses LLMs and static code analysis to autonomously discover remotely exploitable vulnerabilities in Python codebases. It has identified multiple zero-day vulnerabilities, including CVEs in popular repositories, by analyzing call chains from user input to server output. The tool supports vulnerability classes such as LFI, RCE, XSS, and SQL injection.

The Conti ransomware group leaked an internal ranking of endpoint detection and response (EDR) products based on their ease of bypass during real-world attacks. The list places Microsoft Defender for Endpoint, McAfee, and Webroot in the lowest tier, while CrowdStrike is ranked highest. The leak highlights that even top-tier EDRs can be evaded, especially when poorly configured, and underscores the importance of defense-in-depth and proper security tool configuration.

On May 29, 2025, SentinelOne experienced a global service disruption caused by a software flaw in an outgoing infrastructure control system that deleted critical network routes. Customer endpoints remained protected, but the management console and related services were unavailable, impacting security operations. The incident was not security-related and did not affect Federal GovCloud environments.

ConnectWise disclosed a breach by a suspected nation-state actor that impacted a limited number of cloud-hosted ScreenConnect customers. The incident is linked to exploitation of CVE-2025-3935, a ViewState code injection vulnerability patched in April 2025. Attackers may have stolen machine keys to achieve remote code execution on ScreenConnect servers.

The Play ransomware group has compromised approximately 900 organizations since June 2022, using double-extortion tactics. The group exploits SimpleHelp RMM vulnerabilities (CVE-2024-57727, CVE-2024-57728, CVE-2024-57726) for initial access and recompiles ransomware per attack to evade detection. An ESXi variant also targets virtual machines.