#edr-evasion

2 articles

The AI picked 170,000 targets — every break-in used a bug from years ago

2026-08-24Security

Cisco Talos found an exposed directory belonging to UAT-10147 and pulled out target lists of roughly 170,000 URLs, AI tooling across the whole attack lifecycle, and a cross-platform implant called SPECTRE that unlinks EDR callbacks in the kernel using two vulnerable drivers from 2019 and 2021.

Defender ships a driver built to delete locked files at boot — and its encryption key has been the same since Windows 7

2026-08-22Security

Check Point's Jiří Vinopal reverse-engineered BTR.sys, the Boot Time Removal Tool inside Defender, and showed it can be loaded to delete Defender itself in the window after the filesystem comes up but before the antivirus does. Microsoft says it needs admin rights already, so no patch is planned.