Week of January 26, 2026

A local privilege escalation vulnerability (CVE-2025-13176) was disclosed in ESET Inspect Connector for Windows. The flaw allows a low-privileged user to load a malicious DLL into the SYSTEM-level EDR agent process by exploiting a hardcoded OpenSSL configuration path. This can lead to full system compromise and potential bypass of EDR protections.

Bloo's TRI team executed a research project to evaluate Windows Defender's detection of Metasploit payloads. They found that directly generated EXE payloads were blocked, but by exporting raw shellcode, applying XOR encryption, and using a custom C loader, they bypassed Defender's real-time protection and static scanning. The research also explored the Script Web Delivery module for fileless execution.

The Arsenal-237 malware toolkit uses the legitimately signed but vulnerable Baidu driver BdApiUtil64.sys as a Bring-Your-Own-Vulnerable-Driver (BYOVD) component to gain kernel-level access. This enables attackers to terminate security products, steal credentials, and establish persistence, completely bypassing user-mode defenses. Discovery indicates a critical kernel compromise requiring immediate isolation and system rebuild.