Week of July 7, 2025

PhantomLoad is a newly released open-source, fileless shellcode loader designed for red team operations. It implements multiple evasion techniques including syscall unhooking, ETW patching, AMSI bypass, and PPID spoofing to bypass endpoint security products. The tool supports payloads from Cobalt Strike, Meterpreter, and BruteRatel, and is explicitly stated to bypass Defender, CrowdStrike, and SentinelOne.

CVE-2025-6995 is an information disclosure vulnerability in Ivanti Endpoint Manager caused by improper encryption in the agent component. A local authenticated attacker can decrypt other users' passwords stored on the system, enabling credential theft and potential lateral movement. The flaw is classified under CWE-257 (Storing Passwords in a Recoverable Format).

RingReaper is a Linux malware that leverages io_uring for stealthy operations, evading endpoint detection and response (EDR) tools. It uses a custom protocol and advanced techniques to bypass security monitoring on Linux endpoints.