Week of October 13, 2025

A threat actor is distributing 'ShellcodePack Pro', a tool designed to execute malicious shellcode while evading detection by CrowdStrike and Cortex EDRs. The tool lowers the barrier for attackers by packaging sophisticated evasion techniques, and the distributor advises using 'kleenscan' instead of VirusTotal to avoid burning the methods. This poses a direct threat to organizations relying on these EDR platforms.

A hard-coded secret key is used to sign JWTs in Moxa EDR-G9010 Series network security appliances, allowing unauthenticated attackers to forge tokens and gain full administrative control. The vulnerability has a CVSS 4.0 score of 9.9 and affects version 1.0. No patches are available yet, and no in-the-wild exploitation has been observed.

Researchers analyzed 59 .NET malware samples that implement AMSI and ETW bypasses by patching in-memory functions. The samples overwrite AmsiScanBuffer to return E_INVALIDARG or zero out buffer length, and patch EtwEventWrite to disable event tracing. These techniques allow loaders to execute malicious payloads undetected by security tools.

Microsoft disclosed CVE-2025-59497, a time-of-check time-of-use (TOCTOU) race condition in the Defender for Endpoint Linux agent. A local attacker with low privileges can trigger a denial-of-service condition, potentially disabling real-time protection and telemetry. A security update was released on October 14, 2025.

Microsoft disclosed CVE-2025-55330, a BitLocker security feature bypass that allows an attacker with physical access to circumvent encryption protections by manipulating boot-time decision logic. The vulnerability has a CVSS score of 6.1 (Medium) and is addressed by vendor updates. Exploitation does not break AES but targets improper enforcement of behavioral workflow during boot or recovery.

CVE-2024-37283 is a vulnerability in Elastic Agent where secrets from the agent policy elastic-agent.yml are leaked when the log level is set to debug. By default, the log level is info, which prevents the leak. The issue was disclosed in a security update for Elastic Agent 8.15.0.