Week of December 29, 2025

Threat actors known as 'Scattered Lapsus$ Hunters' claimed to have breached cybersecurity firm Resecurity, posting screenshots of alleged internal data. Resecurity stated the accessed systems were a deliberately deployed honeypot containing synthetic data, used to monitor the attackers. The incident highlights the use of deception technology to gather threat intelligence on adversaries.

A research proof-of-concept demonstrates using a BYOVD attack to load a custom unsigned WFP driver, creating a transparent proxy to intercept and block EDR/XDR agent traffic to SOC servers. This bypasses tamper protection and other defenses by operating below the firewall at the kernel level.