NewApp Digest
search bot

service management

Researchers find way to weaponize Windows Defender’s own driver
Winsage
August 22, 2026

Researchers find way to weaponize Windows Defender’s own driver

Check Point Research revealed a technique that uses the boot-time remediation driver BTR.sys, part of Windows Defender, to execute kernel-level operations on Windows systems from Windows 7 to Windows 11 25H2. This method does not exploit software vulnerabilities but leverages BTR.sys, which is designed to remove locked malware components. Researchers reverse-engineered its undocumented protocol, leading to the creation of a proof-of-concept tool, BTR_CLI, that can install the driver as a service without standard management protocols. Once operational, BTR.sys can delete or move files, modify registry entries, and remove security binaries, including parts of Defender, during a specific period when the file system is writable. To exploit this technique, an attacker needs administrator privileges, specifically SeLoadDriverPrivilege. Although Microsoft does not consider this a critical issue due to the requirement of pre-existing administrative access, it highlights a significant potential vulnerability. There have been no documented real-world attacks using this technique.
You will never guess who turns up in this video about why you can't build British towns in SimCity 4
AppWizard
June 21, 2026

You will never guess who turns up in this video about why you can’t build British towns in SimCity 4

YouTuber Chris Spargo analyzes why a SimCity game set in the UK may not resonate as well as its American version, noting that the game's design reflects American city governance, misrepresenting British cities. He discusses the complexities of public service management in the UK, highlighting the role of a British mayor and financial challenges faced by local councils due to centralization and social care costs. The video features a surprise cameo by UK Prime Minister Sir Keir Starmer, who discusses the importance of empowering local communities and the Labour government's commitment to decentralization, granting more authority to local mayors.
Windows SprySOCKS Malware: Advanced Kernel-Level Rootkit Targets Government Organizations via Supply Chain Vulnerabilities
Winsage
June 17, 2026

Windows SprySOCKS Malware: Advanced Kernel-Level Rootkit Targets Government Organizations via Supply Chain Vulnerabilities

The Windows variant of SprySOCKS malware, developed by the Chinese threat group Earth Lusca, targets government entities globally and features advanced capabilities such as rootkit-level stealth and extensive command-and-control (C2) functionalities. It operates on Windows systems, utilizing two main variants: WINDRV, which includes kernel drivers for stealth operations, and WINPLUS, a streamlined backdoor. The malware can communicate over TCP, UDP, and WebSocket, offering over 30 C2 commands for various operations, including system information gathering and keystroke logging. WINDRV loads a driver named ‘RawWNPF’ into memory using another signed kernel driver, allowing it to conceal processes and achieve persistence. The malware's design incorporates open-source elements and exploits vulnerabilities in the software supply chain, notably using a leaked certificate for driver signing. To combat SprySOCKS, organizations are advised to implement advanced endpoint detection and response (EDR) solutions, maintain regular patching, and manage supply chain risks vigilantly. The malware's adaptability and reliance on legitimate certificates complicate detection efforts, necessitating continuous refinement of security practices.
China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth
Winsage
June 16, 2026

China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth

Cybersecurity researchers have identified two new Windows variants of the SprySOCKS backdoor, named WINDRV and WINPLUS, which were previously thought to be exclusive to Linux systems. Both variants feature hard-coded command-and-control configurations and can communicate via TCP, UDP, and WebSocket protocols. They support over 30 commands for operations such as system information collection and file management. WINDRV employs kernel drivers for stealth, obscuring network connections and allowing TCP traffic diversion. SprySOCKS was first documented by Trend Micro in September 2023, linked to the Chinese state-sponsored threat actor Earth Lusca, also known as FishMonger. The Windows variants belong to version 1.8 of SprySOCKS and utilize a kernel driver named RawWNPF for enhanced stealth. The attack chain begins with an initial access method that drops a batch script, leading to the installation of the backdoor. Evidence suggests these variants may have been used in attacks against government organizations in Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024. The WINPLUS variant was first detected in July 2024 in Pakistan. There are indications of a potential UEFI bootkit involvement exploiting CVE-2023-24932, a vulnerability in the Windows Boot Manager.
Rustinel: Open-source endpoint detection for Windows and Linux
Winsage
May 11, 2026

Rustinel: Open-source endpoint detection for Windows and Linux

Open-source endpoint detection tools have typically been divided between Windows and Linux, with Windows solutions focused on Sysmon and Linux solutions on eBPF or auditd. Rustinel is a Rust-based endpoint agent that consolidates these efforts by gathering telemetry from both operating systems using ETW on Windows and eBPF on Linux, normalizing the data into a unified model. It evaluates the information against Sigma rules, YARA signatures, and atomic indicators of compromise, storing alerts in ECS-compatible NDJSON format for integration with SIEM or log-analysis platforms. Rustinel supports a range of events on Windows, including process creation, network activity, and PowerShell executions, while Linux support currently includes process, network, file, and DNS telemetry. It operates in user mode on both platforms, requiring specific conditions for installation. Unlike commercial EDR solutions that use kernel drivers, Rustinel's user-mode design prioritizes simplicity and stability, although it acknowledges limitations in tamper resistance and visibility. The agent utilizes three detection engines: Sigma for behavioral matching, YARA for scanning executables, and an IOC engine for deterministic checks. While it leverages existing content familiar to defenders, it has coverage gaps for certain advanced threats. Rustinel is available on GitHub under the Apache 2.0 license.
Microsoft fixes bug behind Windows Server 2025 automatic upgrades
Winsage
April 15, 2026

Microsoft fixes bug behind Windows Server 2025 automatic upgrades

Microsoft has resolved an issue that caused unexpected upgrades from Windows Server 2019 and 2022 to Windows Server 2025. This problem was first reported in September 2024 when administrators found their servers upgraded without the necessary licenses. Initially, Microsoft attributed the issue to misconfigured third-party update management software, while developers claimed it was due to Microsoft's procedural errors regarding update release speed and classification. Microsoft confirmed the resolution of the issue and re-enabled the upgrade offer through the Windows Update settings. Additionally, Microsoft released an out-of-band update to address complications from a previous non-security preview update and deployed emergency updates to fix sign-in disruptions across various applications. Other updates were issued to resolve Bluetooth visibility issues and security vulnerabilities in the Routing and Remote Access Service management tool.
Anthem is finally, officially dead
AppWizard
January 13, 2026

Anthem is finally, officially dead

At approximately 2:05 PM EST today, players of Anthem were unexpectedly disconnected from EA's servers, marking the official end of the game after nearly seven years since its launch. The game had struggled with live service management and received a lukewarm reception, with a review rating of 55 in February 2019. Development issues and a lack of creative direction plagued Anthem, leading to abandoned plans for reinvention in February 2021. EA announced the game's closure in July, and in its final hours, the community engaged in a nostalgic farewell. Players expressed mixed feelings about the game's experience, highlighting both the thrill of combat and frustrations with its design.
Microsoft's change to Appxsvc may slow some Windows 11 PCs
Winsage
December 30, 2025

Microsoft’s change to Appxsvc may slow some Windows 11 PCs

Microsoft is modifying core system settings for Windows 11 versions 24H2 and 25H2 by enabling the AppX Deployment Service (Appxsvc) to launch automatically upon boot-up, transitioning from a manual trigger system. This change was confirmed in the December 2025 "Patch Tuesday" update (KB5072033) for both Windows 11 and Windows Server 2025. The Appxsvc will now remain active in the background from the moment the computer powers on, regardless of Microsoft Store access, to enhance system stability and minimize app installation failures or update glitches. Microsoft warns against manually reverting this setting, as it could lead to malfunctions in Store apps and essential services. Analysts suggest this move aligns with a strategy for updating Microsoft Store apps directly through Windows Update.
Risks of Manual PostgreSQL Starts in Patroni Clusters: Downtime Warnings
Tech Optimizer
December 1, 2025

Risks of Manual PostgreSQL Starts in Patroni Clusters: Downtime Warnings

Patroni is an open-source tool for managing PostgreSQL clusters, automating failover and replication. Manual starting of PostgreSQL services within an active Patroni cluster can lead to severe disruptions, including data integrity issues and availability risks. Patroni uses a distributed consensus system, often with etcd or Consul, to manage cluster state and leader elections. Manual interventions can confuse this process, resulting in multiple nodes believing they are the primary, which can cause conflicting writes and potential data loss. Real-world incidents have documented outages due to manual starts, such as promoting a replica node to leader status inadvertently. This disrupts Write-Ahead Logging (WAL) synchronization, leading to divergent transaction logs. Database administrators are advised to use Patroni's built-in commands for service management and implement role-based access controls to prevent unauthorized manual actions. Monitoring solutions are crucial for early detection of anomalies. Simulating failure scenarios in staging environments can help prepare teams for real incidents. Ongoing advancements aim to enhance Patroni's safeguards against manual overrides, with future iterations potentially incorporating AI-driven anomaly detection.
Search