Week of November 10, 2025

EfiGuard is an open-source UEFI bootkit that patches the Windows kernel during boot to disable PatchGuard and Driver Signature Enforcement (DSE). It operates before the OS loads, allowing unsigned drivers and kernel modifications without triggering security checks. This demonstrates a persistent, pre-OS attack vector against endpoint security mechanisms.

ZREBypass is a publicly released tool that applies encryption and anti-analysis techniques to binaries, shellcode, and webshells to evade detection by security products. It integrates anti-debugging, anti-VM, and anti-sandbox checks, lowering the barrier for attackers to bypass endpoint defenses.

A red teamer demonstrates patching the AmsiScanBuffer function in memory using Rust to bypass Windows Antimalware Scan Interface (AMSI). The technique loads amsi.dll, locates AmsiScanBuffer, and overwrites its instructions to always return AMSI_RESULT_CLEAN, effectively disabling script content scanning. This allows execution of malicious PowerShell scripts without detection by AMSI-integrated security products.

The Cl0p ransomware group claims to have breached security vendor Entrust by exploiting CVE-2025-61882, a zero-day remote code execution vulnerability in Oracle E-Business Suite. The flaw, rated CVSS 9.8, allows unauthenticated attackers to execute code remotely. Entrust confirmed the breach and is investigating, while Oracle released a patch in October 2025.

Elastic Security Labs discovered a campaign by Dragon Breath APT using a loader called RONINGLOADER that abuses signed kernel drivers to disable Microsoft Defender and other endpoint security products. The malware employs multi-stage evasion including PPL abuse, custom WDAC policies, and process termination to deploy the gh0st RAT. This represents an escalation in APT capabilities for neutralizing security tools.

Fortinet confirmed a critical path confusion vulnerability (CVE-2025-64446) in FortiWeb's GUI component was silently patched after being exploited in the wild. Unauthenticated attackers can execute administrative commands via crafted HTTP/HTTPS requests, creating new admin accounts on exposed devices. The flaw affects multiple FortiWeb versions and has been added to CISA's Known Exploited Vulnerabilities catalog.

A local privilege escalation vulnerability exists in the Qualys Cloud Agent for macOS uninstall script (qagent_uninstall.sh) due to unsafe PATH handling. An attacker with sudo access can manipulate the PATH environment variable to execute arbitrary commands as root during agent uninstallation. The vulnerability affects versions up to 5.1.x and has not been exploited in the wild.

A penetration tester discovered a method to disable Windows Tamper Protection with physical access, enabling remote code execution via a C2 connection. The finding highlights that physical access can undermine a key defense designed to prevent automated tampering of Microsoft Defender settings. The researcher is coordinating responsible disclosure with Microsoft and has not released technical details.

A proof-of-concept demonstrates using Thread Local Storage (TLS) callbacks to modify process command-line arguments after kernel-level EDR logging but before main() execution. This allows malicious arguments to be hidden from security tools that monitor process creation, evading detection without suspicious patterns like suspended processes or cross-process memory writes.

A researcher demonstrated a method to evade EDR detection by using the RegRestoreKey API to revert registry changes made by malicious actions, effectively hiding indicators of compromise. The technique bypasses registry-based detections that rely on current state or event logs, as the restoration can occur before telemetry is processed. This matters because many EDR solutions depend on registry monitoring for threat detection.

A vulnerability in the MiniFilter driver of Avast Free Antivirus before version 25.9 on Windows allows a local attacker with administrative privileges to disable real-time protection and self-defense mechanisms. This could leave the endpoint unprotected against malware. The issue is resolved in version 25.9.

A technique uses the legitimate Microsoft-signed kernel debugger (kd.exe) to nullify EDR kernel callbacks, bypassing detection without loading a vulnerable driver. It requires enabling debug mode and a reboot, then leverages the Debug API to write zeros to callback arrays, effectively deafening the EDR while it appears operational.

The KVC (Kernel Vulnerability Capabilities) framework was published as an open-source tool for Windows security research. It enables unsigned driver loading via DSE bypass and manipulation of process protections to dump LSASS memory, even on systems with HVCI/VBS enabled. The tool is intended for authorized penetration testing and education.

North Korean APT group Kimsuky is using living-off-the-land (LotL) and living-off-the-cloud (LotC) techniques to deploy a fileless backdoor that evades endpoint detection. The attack chain starts with a malicious .LNK file that executes regsvr32.exe to load a malicious DLL, then uses the Outlook Web API for command and control. This allows the backdoor to blend in with normal Microsoft traffic, bypassing EDR and DLP solutions.