Week of August 25, 2025

A proof-of-concept exploit demonstrates bypassing readback protection (RBPCONF) on nRF51 series microcontrollers, allowing extraction of protected firmware over SWD. The technique hijacks a load instruction by manipulating CPU register states and single-stepping, enabling arbitrary flash reads. This matters for endpoint security because nRF51 chips are used in various IoT and embedded devices, potentially exposing sensitive firmware.

Check Point Research uncovered an ongoing campaign by the Silver Fox APT group exploiting a previously unknown vulnerable Microsoft-signed WatchDog Antimalware driver to terminate protected endpoint processes on fully updated Windows systems. The attackers used a dual-driver strategy for compatibility and adapted after a patch by modifying the driver to bypass blocklists while preserving its valid signature. The campaign delivers ValleyRAT as the final payload, highlighting the weaponization of signed-but-vulnerable drivers to evade endpoint protection.

Research details how Windows Defender Application Control (WDAC) policies are being used by threat actors to block endpoint detection and response (EDR) agents. Multiple malware families, including Krueger and a new variant named DreamDemon, have been observed deploying WDAC policies that prevent EDR components from loading. The technique remains effective against many EDR products, with limited preventive capabilities from vendors.

CVE-2025-34160 is a critical unauthenticated remote code execution vulnerability in Aishu AnyShare's ServiceAgent API on port 10250. The flaw allows attackers to inject shell commands via unsanitized input to the /api/ServiceAgent/start_service endpoint. Active exploitation was observed in July 2025, leading to full system compromise.