Week of July 14, 2025

Stern Security researchers used AI to create a custom loader that reads raw shellcode from disk and executes it in memory, bypassing SIEM, XDR, EDR, and AV solutions from major vendors. The technique, dubbed 'Cyborg Bypass', evaded products claiming 100% MITRE ATT&CK detection and multi-layered defenses. This highlights the need for improved detection of in-memory execution and uncommon API usage.

Ukraine's CERT-UA discovered a new malware called LameHug that uses AI to generate commands for execution on compromised Windows endpoints. The malware is deployed in cyber-attacks, indicating active use against targets. This represents a novel integration of AI into malware operations, potentially complicating detection and response.

A local privilege escalation vulnerability (CVE-2025-7433) was disclosed in Sophos Intercept X for Windows with Central Device Encryption 2025.1 and older. It allows arbitrary code execution via deserialization of untrusted data. Sophos has released patches to address the issue.

A vulnerability in Forescout SecureConnector for Windows allows a remote, low-privilege attacker to redirect the agent to a malicious server, leading to remote code execution as SYSTEM. The flaw stems from a named pipe with overly permissive access, enabling command and control of the security agent itself. A patch is available in version 11.3.7.

Defendnot is a proof-of-concept tool that registers a fake antivirus using the Windows Security Center API to disable Microsoft Defender. It injects a stub DLL into a trusted signed process (Taskmgr.exe) to bypass integrity checks. The tool requires administrator rights and leaves the device unprotected.

Diabellstar is a Rust-based proof-of-concept tool that bypasses Event Tracing for Windows (ETW) by patching the NtTraceEvent function in ntdll.dll at runtime. This disables ETW-based telemetry used by EDRs and Windows internals for monitoring process execution. The technique is a known method for evading endpoint detection.