Week of July 28, 2025

A new technique named EDR-Freeze uses Windows Error Reporting (WER) to disable endpoint detection and response (EDR) and antivirus processes without requiring vulnerable drivers. It works by redirecting the WerFault.exe process to overwrite the target security product's executable with a benign file, effectively putting the security tool to sleep.

A use-after-free vulnerability (CVE-2025-38236) was discovered in the Linux kernel's implementation of MSG_OOB for AF_UNIX stream sockets, affecting versions >=6.9. The bug was reachable from the Chrome renderer sandbox on Linux, allowing potential privilege escalation from native code execution to kernel level. The vulnerability was reported and fixed, and Chrome has since blocked MSG_OOB in renderers.

The Qilin ransomware group has adopted a bring-your-own-vulnerable-driver (BYOVD) technique using the legitimate but vulnerable Toshiba driver TPwSav.sys to disable endpoint detection and response (EDR) systems. The attack chain involves DLL sideloading via a Carbon Black update tool and a customized EDRSandblast tool to achieve kernel-level memory manipulation. This allows the ransomware to remove EDR kernel callbacks and evade detection before encrypting files.

Researchers describe a technique where attackers install free trial versions of EDR software on compromised endpoints to disable or interfere with existing security products. This 'Bring Your Own EDR' (BYOEDR) method leverages the high privileges and kernel access of EDR agents to tamper with legitimate defenses. The technique highlights a gap in how security tools manage conflicts with other EDRs.

CVE-2025-25011 is a high-severity vulnerability in Elastic Beats version 8.0.0 caused by insecure directory permissions. An attacker with local low-privilege access can exploit uncontrolled search path elements to move or delete arbitrary files, potentially escalating to SYSTEM privileges. No public exploits have been reported yet, but the flaw poses a significant risk to environments using Beats for data shipping and monitoring.

CISA and international partners released an updated advisory detailing Scattered Spider's tactics, techniques, and procedures as of June 2025. The group uses sophisticated social engineering, MFA bypass, and SIM swapping to gain initial access, then deploys ransomware like DragonForce for data extortion. The advisory provides mitigations for critical infrastructure and commercial facilities.

Netskope Threat Labs analyzed XWorm V6.0, revealing new evasion features including AMSI bypass, stealthy delivery, and anti-analysis capabilities. This version enhances the malware's ability to avoid detection by endpoint security products.