NewApp Digest
search bot

reconnaissance

EDRStartupHinder Disables Antivirus and EDR Protections During Windows 11 25H2 Startup
Winsage
January 12, 2026

EDRStartupHinder Disables Antivirus and EDR Protections During Windows 11 25H2 Startup

A new tool named EDRStartupHinder was unveiled on January 11, 2026, which allows attackers to inhibit the launch of antivirus and endpoint detection and response (EDR) solutions during the Windows startup process. Developed by security researcher Two Seven One Three, it targets Windows Defender and various commercial security products on Windows 11 25H2 systems by redirecting essential system DLLs during boot using the Windows Bindlink API and Protected Process Light (PPL) security mechanisms. The tool employs a four-step attack chain that includes creating a malicious service with higher priority than the targeted security services, redirecting critical DLLs to attacker-controlled locations, and modifying a byte in the PE header of the DLLs to cause PPL-protected processes to refuse loading them. This results in the termination of the security software. EDRStartupHinder has been tested successfully against Windows Defender and other unnamed antivirus products, demonstrating its effectiveness in preventing these security solutions from launching. The source code for EDRStartupHinder is publicly available on GitHub, raising concerns about its potential misuse. Security teams are advised to monitor for Bindlink activity, unauthorized service creation, and registry modifications related to service groups and startup configurations to detect this attack vector. Microsoft has not yet issued any statements regarding patches or mitigations for this technique.
Forgotten 1993 shooter from Duke Nukem dev is back and better than ever with a full remaster thanks to two die-hard fans
AppWizard
December 22, 2025

Forgotten 1993 shooter from Duke Nukem dev is back and better than ever with a full remaster thanks to two die-hard fans

Biomenace Remastered is a fan-made remaster of the classic 1993 shooter developed by Apogee, created by two fans, Niko and Bart, who secured a licensing deal with the original developer, James Norwood. The remaster features the original three episodes with 36 levels and introduces a fourth chapter with 15 additional stages, new NPCs, and two extra boss encounters. It includes a built-in editor for players to create missions, offers seamless transitions between new and classic visuals, and has a quick-save feature. The game incorporates Steam achievements and leaderboards and is verified for Steam Deck. Biomenace Remastered is available on Steam for .99 / £10.23 until December 25, after which the price will increase to .99 / £12.79, with a free demo also available.
VolkLocker Emerges as a Cross-Platform Ransomware Threat Targeting Linux and Windows
Winsage
December 15, 2025

VolkLocker Emerges as a Cross-Platform Ransomware Threat Targeting Linux and Windows

A pro-Russian hacktivist group, CyberVolk, has re-emerged in 2025 with a new ransomware-as-a-service (RaaS) operation called VolkLocker, which targets both Windows and Linux systems using Golang. The group utilizes Telegram bots for command-and-control operations, allowing affiliates to manage ransomware interactions. Despite its advancements, coding errors in the ransomware enable victims to recover encrypted files without paying a ransom. VolkLocker employs AES-256 encryption but has a critical flaw where the master encryption key is hard-coded and saved in plaintext, allowing easy decryption. The ransomware also ensures persistence by replicating itself and disabling essential system tools. CyberVolk offers additional RAT and keylogger add-ons for sale, with complete RaaS packages priced between [openai_gpt model="gpt-4o-mini" prompt="Summarize the content and extract only the fact described in the text bellow. The summary shall NOT include a title, introduction and conclusion. Text: A newly rebooted pro-Russian hacktivist group, CyberVolk, has made a notable comeback in 2025, unveiling a new ransomware-as-a-service (RaaS) operation dubbed VolkLocker, as detailed in recent research by SentinelOne. After a prolonged period of dormancy following extensive bans on Telegram, this group has re-emerged with a Golang-based ransomware solution that targets both Windows and Linux systems. This latest initiative signifies CyberVolk's commitment to revitalizing its operations, showcasing what analysts refer to as the “CyberVolk 2.x” generation of tools. Despite the group's advancements, their integration of sophisticated Telegram-based automation has inadvertently led to coding errors that allow victims to recover their encrypted files without the need to pay a ransom. Telegram-Fueled Automation and Functionality VolkLocker is heavily reliant on Telegram bots for its command-and-control operations, which form the core of its new RaaS model. All interactions between operators and the ransomware's ecosystem, from onboarding new customers to managing victims, are facilitated through a Telegram bot known as CyberVolk_Kbot. This bot provides various commands such as /decrypt, /list, and /status, enabling affiliates to monitor infections and communicate with compromised systems in real time. Operators tasked with creating new ransomware payloads must input several configuration details, including a Bitcoin address, Telegram bot token ID, chat ID, encryption deadline, and file extension. Decryption triggered via backed-up key file This design approach aligns with CyberVolk’s goal of simplifying deployment for affiliates with limited technical skills. The Golang-based payloads, compiled for both Linux and Windows platforms, utilize the “ms-settings” UAC bypass technique (MITRE ATT&CK T1548.002) for privilege escalation. Once operational, VolkLocker performs system reconnaissance, checks for virtual machine environments by matching MAC address prefixes, and strategically excludes key system paths from encryption. Encryption Flaws and System Destruction Features VolkLocker employs AES-256 in Galois/Counter Mode (GCM) for file encryption; however, its encryption design reveals a significant oversight. The master encryption key is hard-coded within the binary and is also saved in a plaintext file named system_backup.key located in the %TEMP% directory. This easily accessible key allows victims to decrypt their files without paying the ransom, highlighting a critical flaw in CyberVolk’s development process. In addition to its encryption capabilities, VolkLocker ensures persistence by replicating itself across multiple directories and disabling essential tools such as Task Manager, Windows Defender, and Command Prompt through registry modifications. It also deletes Volume Shadow Copies and can trigger a Blue Screen of Death (BSOD) using the Windows NtRaiseHardError() function when the countdown timer expires or when incorrect decryption keys are repeatedly entered. Despite these coding missteps, CyberVolk is expanding its offerings, providing RAT and keylogger add-ons for 0 each, along with complete RaaS packages ranging from 0 to ,200. SentinelOne researchers caution that this resurgence underscores how politically motivated groups are increasingly leveraging Telegram infrastructure to commercialize their ransomware operations. Indicators of Compromise: Windows Sample: dcd859e5b14657b733dfb0c22272b82623466321 Linux Sample: 0948e75c94046f0893844e3b891556ea48188608 Bitcoin Wallet: bc1qujgdzl0v82gh9pvmg3ftgnknl336ku26nnp0vy Telegram Bot: 8368663132:AAHBfe3xYPtg1IMynKhQy1BRzuF5UZRZspw Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates" max_tokens="3500" temperature="0.3" top_p="1.0" best_of="1" presence_penalty="0.1" frequency_penalty="frequency_penalty"] and ,200. Indicators of compromise include specific Windows and Linux sample hashes, a Bitcoin wallet address, and a Telegram bot ID.
silver Android smartphone
Tech Optimizer
December 2, 2025

When AI Breaks Bad: The Rise of Ransomware and Deepfakes

Artificial Intelligence (AI) is transforming the cybersecurity landscape by enabling sophisticated cyberattacks, such as ransomware and deepfakes. Ransomware has evolved from manual coding to AI-driven automation, making attacks more efficient and harder to stop. AI automates the targeting of victims by analyzing large datasets to identify vulnerabilities. Machine learning allows malware to change its form to evade detection, and ransomware can operate autonomously within networks. Phishing attacks have become more convincing through AI-generated messages that mimic real communications. Deepfakes can create realistic impersonations, leading to financial fraud and extortion, as demonstrated by a 2024 incident resulting in a million loss. Deepfakes also pose risks for manipulation and disinformation, affecting public perception and market dynamics. On the defensive side, AI is utilized in cybersecurity to detect and prevent attacks through anomaly detection, zero-trust security models, and advanced authentication methods. Human training and awareness are crucial for recognizing AI-generated threats. Effective defense requires regulations, shared accountability, and preparedness within organizations, including continuous monitoring and employee training. Collaboration between public agencies and private security firms is essential for a robust response to cyber threats.
Windows Server Update Service exploitation ensnares at least 50 victims
Winsage
October 31, 2025

Windows Server Update Service exploitation ensnares at least 50 victims

Over 50 organizations in the United States have been targeted in attacks exploiting a vulnerability in the Windows Server Update Service (WSUS), identified as CVE-2025-59287, related to the deserialization of untrusted data. Despite a security update from Microsoft in mid-October, an emergency out-of-band update was issued due to its inadequacy. Sophos recorded six incidents linked to this exploitation, with indications of broader impacts. The affected sectors include technology, education, manufacturing, and healthcare. The hacker group UNC6512 has been connected to these activities, conducting reconnaissance and exfiltrating sensitive data. Sophos detected malicious activity on October 24, following the release of the out-of-band patch. The Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog and urged security teams to apply necessary patches and check for signs of compromise.
China-Linked Hackers Exploit Windows Shortcut Flaw to Target European Diplomats
Winsage
October 31, 2025

China-Linked Hackers Exploit Windows Shortcut Flaw to Target European Diplomats

A China-affiliated threat actor, UNC6384, has been conducting cyber attacks targeting diplomatic and governmental entities in Europe, including Hungary, Belgium, Italy, the Netherlands, and Serbia. These attacks exploit an unpatched Windows shortcut vulnerability (CVE-2025-9491) through spear-phishing emails that appear relevant to diplomatic events. The emails deliver malicious LNK files that deploy PlugX malware via DLL side-loading. PlugX is a remote access trojan that allows extensive control over compromised systems and has been linked to another hacking group, Mustang Panda. Microsoft Defender can detect these attacks, and Smart App Control provides additional protection. The LNK file executes a PowerShell command to extract a TAR archive containing a legitimate utility, a malicious DLL, and an encrypted PlugX payload. The size of the malicious artifacts has decreased significantly, indicating ongoing evolution. UNC6384 has also begun using HTML Application files to load external JavaScript for retrieving malicious payloads, aligning with Chinese intelligence objectives regarding European defense policies.
Warnings Mount Over Windows Server Update Services Hacks
Winsage
October 29, 2025

Warnings Mount Over Windows Server Update Services Hacks

Concerns have increased regarding a critical vulnerability in Windows Server Update Services (WSUS), identified as CVE-2025-59287, which allows unauthenticated attackers to execute arbitrary code. This vulnerability arises from a legacy serialization mechanism within WSUS, which is no longer actively developed. The Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, indicating its urgency. Cybersecurity firms have reported active exploitation attempts, with thousands of WSUS instances exposed to the internet. Attacks are primarily reconnaissance activities that could lead to broader network compromises. If an attacker compromises a single server, they could control the entire patch distribution system, enabling internal supply chain attacks and distributing malware disguised as legitimate Microsoft updates. Alerts have been issued by the Canadian Center for Cybersecurity and the Australian Cyber Security Centre regarding this global threat. Microsoft's initial patch on October 15 failed to fully resolve the issue, allowing attackers to exploit the vulnerability quickly. Attack vectors include exploiting the deserialization of AuthorizationCookie objects and unsafe deserialization via the ReportingWebService. The vulnerability is particularly concerning because WSUS is often neglected and should not be exposed to the internet.
Google probes exploitation of critical Windows service CVE
Winsage
October 28, 2025

Google probes exploitation of critical Windows service CVE

The Google Threat Intelligence Group (GTIG) is investigating cyberattacks linked to a hacker exploiting a vulnerability in the Windows Server Update Service (WSUS), specifically CVE-2025-59287. The threat actor, UNC6512, has targeted multiple organizations, gaining access to systems, conducting reconnaissance, and exfiltrating data. Despite a Microsoft patch released earlier, it has been ineffective. Researchers from HawkTrace and Eye Security have identified suspicious activities related to the vulnerability, with Eye Security noting at least two adversaries exploiting it. Palo Alto Networks Unit 42 confirmed the use of malicious PowerShell commands for exploitation. Shadowserver reported around 2,800 instances exposed to this flaw. The Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog and is urging users to implement the patch. CISA has found no evidence of federal agency impacts but encourages reporting of suspicious activities.
Search