Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by EDR Bypass
čô░ Dirty Frag: Lokale Rechteausweitung im Linux-Kernel (CVE-2026-43284, CVE-2026-43500)
CybersecurityÔÇÖs Dirty Secret: ItÔÇÖs Not IF, ItÔÇÖs WHEN!
čô░ Dirty Frag: Weitere Root-L├╝cke gef├Ąhrdet unz├Ąhlige Linux-Systeme
#rC3 - The Yes Men from Tricksters in an age of dirty tricks
📰 Dirty Hacks: Die Notlügen, die hoffentlich nicht auffallen
His upgrade got me really dirty - AMD $5000 Ultimate Tech Upgrade
Qilin, Warlock Ransomware Disable 300+ EDR Tools
Cybersecurity researchers have uncovered a highly sophisticated ransomware campaign in which threat groups behind Qilin ransomware and Warlock ransomware are using advanced techniques to disable security defenses on compromised systems. According to findings from Cisco Talos and Trend Micro, attackers are leveraging a method known as Bring Your Own Vulnerable Driver (BYOVD) to bypass endpoint detection and response (EDR) tools.
🔒 NtKiller Tool Boasts AV/EDR Evasion on Dark Web
A threat actor dubbed AlphaGhoul has now begun to push NtKiller-a perilous tool-on the dark web forums, claiming it silently kills antivirus software and bypasses endpoint detection and response systems. As a malware loader, this tool targets popular security… The post NtKiller Tool Boasts AV/EDR Evasion on Dark Web appeared first on IT Security News.
Threat Actors Advertised NtKiller Malware on Dark Web Claiming Terminate Antivirus and EDR Bypass
A malicious actor known as AlphaGhoul has begun promoting a tool called NtKiller, designed to silently shut down antivirus software and endpoint detection tools. The tool was posted on an underground forum where criminals gather to buy and sell hacking services.
🔒 Mustang Panda Adopts New DLL Side-Loading Method to Deploy Malware
The sophisticated China-linked threat actor Mustang Panda has refined its cyber espionage arsenal with an advanced DLL side-loading technique specifically targeting the Tibetan community, according to recent analysis of a campaign first identified by IBM’s X-Force in June 2025.
🔒 China-linked Mustang Panda deploys advanced SnakeDisk USB worm
China-linked APT group Mustang Panda has been spotted using a new USB worm called SnakeDisk along with a new version of known malware China-linked APT group Mustang Panda (aka Hive0154, Camaro Dragon, RedDelta or Bronze President) has been spotted using an updated version of the TONESHELL backdoor and a previously undocumented USB worm called SnakeDisk. Mustang Panda has been active since […] ...
🔒 Mustang Panda Uses SnakeDisk USB Worm and Toneshell Backdoor to Target Air-Gap Systems
🕵️ Mustang Panda Uses SnakeDisk USB Worm and Toneshell Backdoor to Target Air-Gap Systems IBM X-Force researchers have uncovered sophisticated new malware campaigns orchestrated by the China-aligned threat actor Hive0154, also known as Mustang Panda. The discovery includes an advanced Toneshell backdoor variant that evades detection systems and a novel USB worm called SnakeDisk specifically targeting Thailand-based devices.
🔒 China-Based Threat Actor Mustang Panda’s TTPs Leaked
A significant milestone for cybersecurity experts is the disclosure of specific tactics, methods, and procedures (TTPs) used by Mustang Panda, an advanced persistent threat (APT) group based in China, which has illuminated their intricate activities.
🔒 New Crypto24 Ransomware Attacks Bypass EDR
📰 New "Bring Your Own Installer" EDR bypass used in ransomware attack 📈 26.59 Punkte 📰 IT Security Nachrichten 🎥 EDR Is Dead, EDR Is Not Dead - PSW #849 📈 26.56 Punkte 🎥 IT Security Video 🎥 The Dark Side of EDR: Repurpose EDR as an Offensive Tool 📈 26.56 Punkte 🎥 IT Security Video 📰 EDR Importance: Why Is EDR Important?
🔒 Mustang Panda Targets Windows Users with ToneShell Malware Disguised as Google Chrome
The China-aligned threat actor Mustang Panda, also known as Earth Preta, HIVE0154, RedDelta, and Bronze President, has been deploying the ToneShell backdoor against Windows users, primarily targeting government and military entities in the Asia-Pacific and Europe.
🔒 Hacker Finds New Technique to Bypass SentinelOne EDR Solution
📰 New ‘Bring Your Own Installer (BYOI)’ technique allows to bypass EDR 📈 35.16 Punkte 📰 IT Security Nachrichten 🎥 EDR Is Dead, EDR Is Not Dead - PSW #849 📈 26.82 Punkte 🎥 IT Security Video 🎥 The Dark Side of EDR: Repurpose EDR as an Offensive Tool 📈 26.82 Punkte 🎥 IT Security Video 📰 EDR Importance: Why Is EDR Important?
🔒 New ‘Bring Your Own Installer (BYOI)’ technique allows to bypass EDR
🎥 EDR Is Dead, EDR Is Not Dead - PSW #849 📈 26.86 Punkte 🎥 IT Security Video 🎥 The Dark Side of EDR: Repurpose EDR as an Offensive Tool 📈 26.86 Punkte 🎥 IT Security Video 📰 EDR Importance: Why Is EDR Important?
🔒 New "Bring Your Own Installer" EDR bypass used in ransomware attack
🎥 EDR Is Dead, EDR Is Not Dead - PSW #849 📈 26.87 Punkte 🎥 IT Security Video 🎥 The Dark Side of EDR: Repurpose EDR as an Offensive Tool 📈 26.87 Punkte 🎥 IT Security Video 📰 EDR Importance: Why Is EDR Important? (With Use Cases) 📈 26.87 Punkte 📰 IT Security Nachrichten 📰 AuKill Malware Actively Used To Disable EDR In Ongoing Attacks 📈 20.72 Punkte 📰 IT Security Nachrichten 📰 Ransomware attackers introduce new EDR killer to their arsenal 📈 20.47 Punkte 📰 IT Security Nachrichten
Mario Kart World's Free Roam Looks Like The Burnout Paradise Sequel I've Been Dreaming Of
I’m excited to play Mario Kart World for all the obvious reasons, not least among them that it’s the first new Mario Kart in 11 years. But today’s mini Mario Kart Direct confirmed for me that I’m most interested in the Free Roam mode. It’s the B Apr 20 2025 1 10486 Views Im excited to play Mario Kart World for all the obvious reasons, not least among them that its the first new Mario Kart in 11 years.
Android users just dodged a bullet as the CVE cybersecurity tracker stays funded
You may not know it, but if you have an internet-connected device, you have the CVE program to thank for device security. We all almost lost it.
PlaySeat Trophy SIM Racing Cockpit: Logitech G Edition $509.15, Red $480 + Free Shipping
Is there a way to mount a monitor to this to who ever is using one currently? Thank you in advance.Such as this one: https://a.co/d/hmLmlzl
Funding restored for crucial cybersecurity program, but uncertainty remains
Federal funding has been restored for a crucial cybersecurity program used by Apple and other tech giants, in a last-minute U-turn. Security experts had described the original decision to remove funding as stupid, dangerous, and chaotic. However, Apr 20 2025 8 268 Views Federal funding has been restored for a crucial cybersecurity program used by Apple and other tech giants, in a last-minute U-turn.
Vintage Game Rides Again Thanks to Modern Tech
You have to admire the lengths designers went to back in the day to create engaging games and toys. One particularly clever game of this type was called GEE-WIZ, a horse racing game from the 1920s … Apr 20 2025 2 13502 Views You have to admire the lengths designers went to back in the day to create engaging games and toys. One particularly clever game of this type was called GEE-WIZ, a horse racing game from the 1920s th… [+1415 chars] Sharing with friends or Social Media
Weight loss in a pill? Eli Lilly just took a big step closer to making it happen
Easy Branches allows you to share your guest post within our network in any countries of the world to reach Global customers start sharing your stories today!
Shock as 200-1 Heavenly Heather wins at Newcastle
Sport Racing Shock as 200-1 Heavenly Heather wins at Newcastle A major horse racing shock happens on Good Friday as 200-1 outsider Heavenly Heather wins at Newcastle.
Mustang Panda Targets Myanmar With StarProxy, EDR Bypass, and TONESHELL Updates
The China-linked threat actor known as Mustang Panda has been attributed to a cyber attack targeting an unspecified organization in Myanmar with previously unreported tooling, highlighting continued effort by the threat actors to increase the sophist Apr 20 2025 72 328 Views The China-linked threat actor known as Mustang Panda has been attributed to a cyber attack targeting an unspecified organization in Myanmar with previously unreported tooling, highlighting continued … [+5509 chars]...
Apple Patches Two Actively Exploited iOS Flaws Used in Sophisticated Targeted Attacks
Apple on Wednesday released security updates for iOS, iPadOS, macOS Sequoia, tvOS, and visionOS to address two security flaws that it said have come under active exploitation in the wild. The vulnerabilities in question are listed below - CVE-2025-3 Apr 20 2025 46 304 Views Apple on Wednesday released security updates for iOS, iPadOS, macOS Sequoia, tvOS, and visionOS to address two security flaws that it said have come under active exploitation in the wild.
CVE-2025-24054 Under Active Attack—Steals NTLM Credentials on File Download | The Cyber Security News
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a medium-severity security flaw impacting Microsoft Windows to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild. The vulnerability, assigned the CVE identifier CVE-2025-24054 (CVSS score: 6.5), is a Windows New Technology LAN Manager (NTLM) hash disclosure spoofing bug that was patched by Microsoft last month as part of its Patch Tuesday updates.
IT Security News Daily Summary 2025-04-17
173 posts were published in the last hour 21:32 : Google Digital Ad Network Ruled Illegal Monopoly By Judge 21:31 : CISA Urges Action on Potential Oracle Cloud Credential Compromise 21:31 : CrazyHunter Hacker Group Using Open-Source Tools from GitHub to Attack Organizations 21:2 : Announcing AWS Security Reference Architecture Code Examples for Generative AI 20:32 : Publisher's Spotlight: Veriti 20:31 : China-linked APT Mustang Panda upgrades tools in its arsenal 20:5 : IT Security News...
Mustang Panda Targets Myanmar With StarProxy, EDR Bypass, and TONESHELL Updates Original
The China-linked threat actor known as Mustang Panda has been attributed to a cyber attack targeting an unspecified organization in Myanmar with previously unreported tooling, highlighting continued effort by the threat actors to increase the sophistication and effectiveness of their malware.
EDR Silencer and Beyond: Exploring Methods to Block EDR Communication - Part 2
Attackers continuously innovate new ways to bypass security measures. Recently, a new technique called EDR Silencer has gained attention for its ability to disable EDR solutions. The method works by leveraging Windows Firewall rules to block EDR agents’ communication with their management centers, effectively cutting off telemetry, resulting in no telemetry or alert generated on the management console.
Hackers Using AV/EDR Tool "EDRSandBlast" To Bypass Endpoints
AV, anti-malware, and EDR are tools that are primarily used to detect and prevent cyber-attacks. While the AV/EDR bypass tools are designed to evade detection by AV and EDR systems. These tools are often used by threat actors for several malicious purposes. Cybersecurity researchers at Palo Alto Networks’ Unit 42 recently discovered that hackers have been actively using AV and EDR bypass tools from cybercrime forums to bypass endpoints.
Advantage Attacker: EDR Bypass Tools | Scarecrow
Over the last 10-12 years, EDR solutions have become a mainstay in endpoint defense. The reason for the dramatic adoption of EDR solutions was because Anti-Virus (AV) solutions at the time were (and still are) unable to detect a new wave of undetectable threats. Document-based attacks with macro’s and fileless malware contributed to the inevitable downfall of AV as we know it.
RansomHub Ransomware Using Multiple Techniques To Disable EDR And Antivirus
RansomHub is well-known for its affiliate scheme and for employing methods to turn off or disable endpoint detection and response (EDR) to avoid discovery and extend its existence on hacked devices or networks. Experts discovered that Ransomhub integrated the EDRKillShifter into its attack chain, a novel evasion method.
Windows MiniFilter Can Be Abused tTo Bypass EDR
The Windows MiniFilter driver, like the Sysmon driver, can be abused to prevent EDR drivers from loading. Endpoint Detection and Response (EDR) processes are difficult for adversaries to stop, even with local administrator or system-level access to an endpoint, because they are made to function autonomously and persistently.
Malware EDR Evasion Techniques
8 minute read Yo, how’s it going everyone. Sorry it’s been a while since my last post. Fear not, I’m geared up and ready to dive in to a full discussion on Malware evasive maneuvers…specifically, .js files for the first drops on a machine. Oh and yes, you’re reading that correctly. I said .js, because believe it or not it is still actively used and HIGHLY effective at bypassing your most common EDR solutions today. Why is that?
Acheron - Indirect Syscalls For AV/EDR Evasion In Go Assembly
Acheron is a library inspired by SysWhisper3/FreshyCalls/RecycledGate, with most of the functionality implemented in Go assembly. acheron package can be used to add indirect syscall capabilities to your Golang tradecraft, to bypass AV/EDRs that makes use of usermode hooks and instrumentation callbacks to detect anomalous syscalls that don’t return to ntdll.dll, when the call transition back from kernel->userland.
ScareCrow : Payload Creation Framework Designed Around EDR Bypass
ScareCrow is a payload creation framework for generating loaders for the use of side loading (not injection) into a legitimate Windows process (bypassing Application Whitelisting controls). Once the DLL loader is loaded into memory, utilizing a technique to flush an EDR’s hook out the system DLLs running in the process’s memory. This works because we know the EDR’s hooks are placed when a process is spawned.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with EDR
Contact EDR, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack