Week of February 23, 2026

SynthAPT is an open-source adversary simulation framework that uses JSON playbooks to define attack paths, which are compiled into functional shellcode payloads. It integrates an LLM agent to generate playbooks from natural language or threat intelligence, enabling rapid creation of realistic malware scenarios for testing endpoint detections.

A proof-of-concept tool named defender-acl-blocker modifies ACLs on kernel32.dll to add Deny ACEs for Windows Defender and Sysmon service identities, preventing them from starting after reboot. The technique requires administrator privileges and leaves minimal telemetry, with detection possible via Windows Security Event ID 4670.

Trend Micro disclosed eight vulnerabilities in Apex One, including two critical unauthenticated remote code execution flaws in the management console. The vulnerabilities were patched in February 2026. The critical flaws allow attackers to upload and execute arbitrary code via directory traversal.

Researchers disclosed that Palo Alto Networks Cortex XDR Live Terminal feature can be abused as a command-and-control channel. The trusted EDR agent component allows attackers to bypass detection by blending traffic with normal operations. Two methods were demonstrated: cross-tenant token reuse and a custom server exploiting a URL validation flaw.

CVE-2026-2914 is a privilege escalation vulnerability in CyberArk Endpoint Privilege Manager Agent versions 25.10.0 and lower. It allows authenticated local users to exploit elevation dialogs to gain unauthorized elevated privileges. The flaw has low attack complexity and high impact on confidentiality, integrity, and availability.

A proof-of-concept tool demonstrates a technique to load .NET assemblies in memory without triggering AMSI scanning by using the IHostAssemblyStore interface and AppDomain.Load_2 instead of the commonly monitored Load_3. The implementation includes a pure Rust PE metadata parser to automatically extract assembly identity, enabling stealthy in-memory execution.

Security researcher Andrea Varischio developed Doppelganger, a proof-of-concept tool that clones the LSASS process to extract credentials without touching the protected original. The technique bypasses EDR hooks, PPL, and monitoring by operating on a copy, leveraging BYOVD to disable PPL in kernel memory. This matters because it demonstrates a novel evasion method against modern EDRs that protect LSASS.

A new custom remote access trojan named MIMICRAT is being distributed through a sophisticated multi-stage ClickFix campaign. The attack chain uses obfuscated PowerShell scripts to disable Windows Event Tracing and AMSI, then deploys the RAT for data exfiltration and command execution. This technique directly undermines endpoint detection mechanisms.

SysWhispers4 is a Python-based tool that generates C/ASM code for direct and indirect system calls to bypass AV/EDR user-mode hooks. It introduces new syscall number resolution methods (SyscallsFromDisk, RecycledGate, HW Breakpoint) and evasion features like AMSI bypass, ntdll unhooking, and anti-debugging, targeting Windows NT 3.1 through Windows 11 24H2 across multiple architectures.