{"vulnerability": "CVE-2019-16098", "sightings": [{"uuid": "0d66f302-6e1e-4162-b605-55254e641b42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "seen", "source": "MISP/a9eb9e8e-d894-4f36-a6c2-ca8142f72d29", "content": "", "creation_timestamp": "2024-05-21T13:04:44.000000Z"}, {"uuid": "9d4ca029-fa0b-4bc8-8ba5-bf790b4bb8bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:00:54.000000Z"}, {"uuid": "9428fc9d-0644-453e-96ff-fd110d46785c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "seen", "source": "MISP/a9eb9e8e-d894-4f36-a6c2-ca8142f72d29", "content": "", "creation_timestamp": "2026-02-06T21:11:55.000000Z"}, {"uuid": "5fe9a99e-39f5-4c23-83d1-81cc30d2385f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "exploited", "source": "https://t.me/true_secator/3524", "content": "BlackByte \u0432\u0437\u044f\u043b\u0438 \u043d\u0430 \u0432\u043e\u043e\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 Bring Your Own Driver (BYOVD).\n\n\u0412\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u0435 \u0430\u0442\u0430\u043a\u0438 \u0431\u044b\u043b\u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u044b \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438  \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 CVE-2019-16098 \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 MSI Afterburner RTCore64.sys.\n\n\u0423\u0432\u0435\u0440\u0435\u043d\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u0430\u00a0BlackByte\u00a0\u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u044b, \u043f\u0440\u0435\u043f\u044f\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u0435 EDR, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f.\n\nBYOVD \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u0435\u043d, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u044b \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u044b \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u043c \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0442\u0441\u044f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0441 \u0432\u044b\u0441\u043e\u043a\u0438\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438.\n\n\u0410\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0438 Lazarus, \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u044f\u044f \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u043e\u043c Dell, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0430\u043a\u0442\u043e\u0440\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0430\u043d\u0442\u0438\u0447\u0438\u0442\u0435\u0440\u0441\u043a\u0438\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 \u0434\u043b\u044f \u0438\u0433\u0440\u044b Genshin Impact.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u044f\u0441\u043d\u044f\u044e\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u044f\u0435\u043c\u044b\u0439 \u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 MSI \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442 \u043a\u043e\u0434\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0432\u0432\u043e\u0434\u043e\u043c-\u0432\u044b\u0432\u043e\u0434\u043e\u043c, \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0440\u0435\u0436\u0438\u043c\u0430, \u0447\u0442\u043e \u043d\u0430\u0440\u0443\u0448\u0430\u0435\u0442 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Microsoft \u0432 \u043e\u0442\u043d\u043e\u0448\u0435\u043d\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430.\n\n\u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0447\u0438\u0442\u0430\u0442\u044c, \u043f\u0438\u0441\u0430\u0442\u044c \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 \u0431\u0435\u0437 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0448\u0435\u043b\u043b-\u043a\u043e\u0434\u0430 \u0438\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430.\n\n\u041d\u0430 \u043f\u0435\u0440\u0432\u043e\u043c \u044d\u0442\u0430\u043f\u0435 \u0430\u0442\u0430\u043a\u0438 BlackByte \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u0442 \u0432\u0435\u0440\u0441\u0438\u044e \u044f\u0434\u0440\u0430, \u0447\u0442\u043e\u0431\u044b \u0432\u044b\u0431\u0440\u0430\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u044b\u0435 \u0441\u043c\u0435\u0449\u0435\u043d\u0438\u044f, \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0443 \u044f\u0434\u0440\u0430. \u0417\u0430\u0442\u0435\u043c RTCore64.sys \u043f\u043e\u043c\u0435\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u00abAppData\\Roaming\u00bb \u0438 \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u0441\u043b\u0443\u0436\u0431\u0443, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0436\u0435\u0441\u0442\u043a\u043e \u0437\u0430\u0434\u0430\u043d\u043d\u043e\u0435 \u0438\u043c\u044f \u0438 \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u043e \u0432\u044b\u0431\u0440\u0430\u043d\u043d\u043e\u0435 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0435\u043c\u043e\u0435 \u0438\u043c\u044f.\n\n\u0417\u0430\u0442\u0435\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u044f\u0434\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\u041f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0435 \u0430\u0434\u0440\u0435\u0441\u0430 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0432\u044b\u0437\u043e\u0432\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043c\u0435\u043d\u0438 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 \u0438 \u0441\u0440\u0430\u0432\u043d\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u0441\u043e \u0441\u043f\u0438\u0441\u043a\u043e\u043c \u0438\u0437 1000 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u044e \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 AV/EDR.\n\n\u041b\u044e\u0431\u044b\u0435 \u0441\u043e\u0432\u043f\u0430\u0434\u0435\u043d\u0438\u044f, \u043d\u0430\u0439\u0434\u0435\u043d\u043d\u044b\u0435 \u043d\u0430 \u044d\u0442\u043e\u043c \u044d\u0442\u0430\u043f\u0435, \u0443\u0434\u0430\u043b\u044f\u044e\u0442\u0441\u044f \u043f\u0443\u0442\u0435\u043c \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 \u043d\u0443\u043b\u044f\u043c\u0438 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u0430, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0433\u043e \u0430\u0434\u0440\u0435\u0441 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0432\u044b\u0437\u043e\u0432\u0430, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 \u0430\u043d\u043d\u0443\u043b\u0438\u0440\u0443\u0435\u0442\u0441\u044f.\n\nSophos \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442, \u0447\u0442\u043e BlackByte \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0432 \u044d\u0442\u0438\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u043f\u043e\u0438\u0441\u043a \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u043e\u0432 \u0440\u0430\u0431\u043e\u0442\u044b \u043e\u0442\u043b\u0430\u0434\u0447\u0438\u043a\u0430 \u0432 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u0432\u044b\u0445\u043e\u0434 \u0438\u0437 \u043d\u0435\u0433\u043e.\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 BlackByte \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u0441\u043f\u0438\u0441\u043e\u043a \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0445 DLL-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 Avast, Sandboxie, \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u043e\u0439 Windows DbgHelp \u0438 Comodo Internet Security, \u0438 \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u0435\u0442 \u0441\u0432\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f.\n\n\u0421\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b \u043c\u043e\u0433\u0443\u0442 \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c\u0441\u044f \u043e\u0442 \u043d\u043e\u0432\u043e\u0433\u043e \u043f\u0440\u0438\u0435\u043c\u0430 \u043e\u0431\u0445\u043e\u0434\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 BlackByte, \u0434\u043e\u0431\u0430\u0432\u0438\u0432 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 MSI \u0432 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0439 \u0447\u0435\u0440\u043d\u044b\u0439 \u0441\u043f\u0438\u0441\u043e\u043a.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b \u0434\u043e\u043b\u0436\u043d\u044b \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0432\u0441\u0435 \u0441\u043e\u0431\u044b\u0442\u0438\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u043e\u0432 \u0438 \u043f\u043e\u0447\u0430\u0449\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0442\u044c \u0438\u0445, \u0447\u0442\u043e\u0431\u044b \u043d\u0430\u0439\u0442\u0438 \u043c\u043e\u0448\u0435\u043d\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0435 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044e.", "creation_timestamp": "2022-10-06T17:35:04.000000Z"}, {"uuid": "13e796d8-a188-4782-99dc-76a7dfff4bea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mtjpe5xp2n2n", "content": "@talosintelligence.com\nChinese-speaking actor UAT-10147 deploys SPECTRE backdoor with Linux rootkit and BYOVD EDR evasion.\n-\nIOCs: CVE-2019-16098, CVE-2021-21551\n-\n#Rootkit #SPECTRE #ThreatIntel", "creation_timestamp": "2026-08-20T16:51:20.874654Z"}, {"uuid": "e41b72f8-0bf5-4631-8f6f-5114bb783e31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "seen", "source": "https://t.me/EchelonEyes/756", "content": "\u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c BlackByte \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 Windows, \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\n\n\u0411\u0440\u0438\u0442\u0430\u043d\u0441\u043a\u0438\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 Sophos \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0441\u0432\u0435\u0436\u0438\u0439 \u043f\u0440\u0438\u043c\u0435\u0440 \u0430\u0442\u0430\u043a\u0438 \u0441 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 (bring your own vulnerable driver - BYOVD). \u0414\u0430\u043d\u043d\u043e\u0439 \u0442\u0430\u043a\u0442\u0438\u043a\u043e\u0439 \u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044f BlackByte. \u0423\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044f \u0432 Windows \u0437\u0430\u043a\u043e\u043d\u043d\u044b\u0439, \u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 Micro-Star MSI Afterburner (RTCore64.sys), \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 (CVE-2019-16098, \u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 7,8) \u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u043b\u0438 \u0441\u043b\u0443\u0436\u0431\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\u00ab\u0422\u0435\u0445\u043d\u0438\u043a\u0430 \u0443\u043a\u043b\u043e\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0433\u043e \u0441\u043f\u0438\u0441\u043a\u0430 \u0438\u0437 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 1000 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u043e\u0432, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442\u0441\u044f \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0442\u044b\u00bb, \u2014 \u0441\u043a\u0430\u0437\u0430\u043b \u0432 \u043d\u043e\u0432\u043e\u043c \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u043e\u0431\u0437\u043e\u0440\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0443\u0433\u0440\u043e\u0437 Sophos \u0410\u043d\u0434\u0440\u0435\u0430\u0441 \u041a\u043b\u043e\u043f\u0448.\n\nBlackByte \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043d\u043e\u0432\u0435\u0439\u0448\u0435\u0435 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 BYOVD, \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e \u043c\u043e\u0434\u0435\u043b\u0438 randsom-as-a-service (Raas), \u0442\u043e \u0435\u0441\u0442\u044c \u043f\u0440\u0438\u043e\u0431\u0440\u0435\u0441\u0442\u0438 \u0433\u043e\u0442\u043e\u0432\u044b\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u043c\u043e\u0436\u0435\u0442 \u043b\u044e\u0431\u043e\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a. \u041a \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u043e\u0432 \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0433\u043e\u0434\u044b \u0432\u0441\u0435 \u0447\u0430\u0449\u0435 \u043f\u0440\u0438\u0431\u0435\u0433\u0430\u044e\u0442 \u043f\u0440\u043e\u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u0435 \u0433\u0440\u0443\u043f\u043f\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Slingshot, InvisiMole, APT28 \u0438 Lazarus.\n\n\u0414\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 BYOVD-\u0430\u0442\u0430\u043a \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u044b, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0438 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0442\u044c \u0438\u0445 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0438\u043b\u0438 \u0437\u0430\u043d\u043e\u0441\u0438\u0442\u044c \u0432 \u0447\u0435\u0440\u043d\u044b\u0439 \u0441\u043f\u0438\u0441\u043e\u043a \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u044b, \u043e \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e, \u0447\u0442\u043e \u043e\u043d\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://news.sophos.com/en-us/2022/10/04/blackbyte-ransomware-returns/ \n\n#BYOVD #BlackByte", "creation_timestamp": "2026-07-26T02:02:37.987641Z"}, {"uuid": "f38cfe1d-724b-4b7f-b55c-3a07d14e3e5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "seen", "source": "https://t.me/EchelonEyes/756", "content": "\u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c BlackByte \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 Windows, \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\n\n\u0411\u0440\u0438\u0442\u0430\u043d\u0441\u043a\u0438\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 Sophos \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0441\u0432\u0435\u0436\u0438\u0439 \u043f\u0440\u0438\u043c\u0435\u0440 \u0430\u0442\u0430\u043a\u0438 \u0441 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 (bring your own vulnerable driver - BYOVD). \u0414\u0430\u043d\u043d\u043e\u0439 \u0442\u0430\u043a\u0442\u0438\u043a\u043e\u0439 \u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044f BlackByte. \u0423\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044f \u0432 Windows \u0437\u0430\u043a\u043e\u043d\u043d\u044b\u0439, \u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 Micro-Star MSI Afterburner (RTCore64.sys), \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 (CVE-2019-16098, \u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 7,8) \u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u043b\u0438 \u0441\u043b\u0443\u0436\u0431\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\u00ab\u0422\u0435\u0445\u043d\u0438\u043a\u0430 \u0443\u043a\u043b\u043e\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0433\u043e \u0441\u043f\u0438\u0441\u043a\u0430 \u0438\u0437 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 1000 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u043e\u0432, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442\u0441\u044f \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0442\u044b\u00bb, \u2014 \u0441\u043a\u0430\u0437\u0430\u043b \u0432 \u043d\u043e\u0432\u043e\u043c \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u043e\u0431\u0437\u043e\u0440\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0443\u0433\u0440\u043e\u0437 Sophos \u0410\u043d\u0434\u0440\u0435\u0430\u0441 \u041a\u043b\u043e\u043f\u0448.\n\nBlackByte \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043d\u043e\u0432\u0435\u0439\u0448\u0435\u0435 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 BYOVD, \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e \u043c\u043e\u0434\u0435\u043b\u0438 randsom-as-a-service (Raas), \u0442\u043e \u0435\u0441\u0442\u044c \u043f\u0440\u0438\u043e\u0431\u0440\u0435\u0441\u0442\u0438 \u0433\u043e\u0442\u043e\u0432\u044b\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u043c\u043e\u0436\u0435\u0442 \u043b\u044e\u0431\u043e\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a. \u041a \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u043e\u0432 \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0433\u043e\u0434\u044b \u0432\u0441\u0435 \u0447\u0430\u0449\u0435 \u043f\u0440\u0438\u0431\u0435\u0433\u0430\u044e\u0442 \u043f\u0440\u043e\u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u0435 \u0433\u0440\u0443\u043f\u043f\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Slingshot, InvisiMole, APT28 \u0438 Lazarus.\n\n\u0414\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 BYOVD-\u0430\u0442\u0430\u043a \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u044b, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0438 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0442\u044c \u0438\u0445 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0438\u043b\u0438 \u0437\u0430\u043d\u043e\u0441\u0438\u0442\u044c \u0432 \u0447\u0435\u0440\u043d\u044b\u0439 \u0441\u043f\u0438\u0441\u043e\u043a \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u044b, \u043e \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e, \u0447\u0442\u043e \u043e\u043d\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://news.sophos.com/en-us/2022/10/04/blackbyte-ransomware-returns/ \n\n#BYOVD #BlackByte", "creation_timestamp": "2026-07-27T00:01:14.984848Z"}, {"uuid": "47ec7fd7-94eb-407a-8d5a-b00350387eec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "exploited", "source": "https://t.me/EchelonEyes/756", "content": "\u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c BlackByte \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 Windows, \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\n\n\u0411\u0440\u0438\u0442\u0430\u043d\u0441\u043a\u0438\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 Sophos \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0441\u0432\u0435\u0436\u0438\u0439 \u043f\u0440\u0438\u043c\u0435\u0440 \u0430\u0442\u0430\u043a\u0438 \u0441 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 (bring your own vulnerable driver - BYOVD). \u0414\u0430\u043d\u043d\u043e\u0439 \u0442\u0430\u043a\u0442\u0438\u043a\u043e\u0439 \u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044f BlackByte. \u0423\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044f \u0432 Windows \u0437\u0430\u043a\u043e\u043d\u043d\u044b\u0439, \u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 Micro-Star MSI Afterburner (RTCore64.sys), \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 (CVE-2019-16098, \u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 7,8) \u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u043b\u0438 \u0441\u043b\u0443\u0436\u0431\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\u00ab\u0422\u0435\u0445\u043d\u0438\u043a\u0430 \u0443\u043a\u043b\u043e\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0433\u043e \u0441\u043f\u0438\u0441\u043a\u0430 \u0438\u0437 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 1000 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u043e\u0432, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442\u0441\u044f \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0442\u044b\u00bb, \u2014 \u0441\u043a\u0430\u0437\u0430\u043b \u0432 \u043d\u043e\u0432\u043e\u043c \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u043e\u0431\u0437\u043e\u0440\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0443\u0433\u0440\u043e\u0437 Sophos \u0410\u043d\u0434\u0440\u0435\u0430\u0441 \u041a\u043b\u043e\u043f\u0448.\n\nBlackByte \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043d\u043e\u0432\u0435\u0439\u0448\u0435\u0435 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 BYOVD, \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e \u043c\u043e\u0434\u0435\u043b\u0438 randsom-as-a-service (Raas), \u0442\u043e \u0435\u0441\u0442\u044c \u043f\u0440\u0438\u043e\u0431\u0440\u0435\u0441\u0442\u0438 \u0433\u043e\u0442\u043e\u0432\u044b\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u043c\u043e\u0436\u0435\u0442 \u043b\u044e\u0431\u043e\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a. \u041a \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u043e\u0432 \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0433\u043e\u0434\u044b \u0432\u0441\u0435 \u0447\u0430\u0449\u0435 \u043f\u0440\u0438\u0431\u0435\u0433\u0430\u044e\u0442 \u043f\u0440\u043e\u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u0435 \u0433\u0440\u0443\u043f\u043f\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Slingshot, InvisiMole, APT28 \u0438 Lazarus.\n\n\u0414\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 BYOVD-\u0430\u0442\u0430\u043a \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u044b, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0438 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0442\u044c \u0438\u0445 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0438\u043b\u0438 \u0437\u0430\u043d\u043e\u0441\u0438\u0442\u044c \u0432 \u0447\u0435\u0440\u043d\u044b\u0439 \u0441\u043f\u0438\u0441\u043e\u043a \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u044b, \u043e \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e, \u0447\u0442\u043e \u043e\u043d\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://news.sophos.com/en-us/2022/10/04/blackbyte-ransomware-returns/ \n\n#BYOVD #BlackByte", "creation_timestamp": "2026-07-28T07:00:06.540147Z"}, {"uuid": "d239952b-6a3f-47a8-80af-b3335d79a457", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "exploited", "source": "https://t.me/EchelonEyes/756", "content": "\u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c BlackByte \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 Windows, \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\n\n\u0411\u0440\u0438\u0442\u0430\u043d\u0441\u043a\u0438\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 Sophos \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0441\u0432\u0435\u0436\u0438\u0439 \u043f\u0440\u0438\u043c\u0435\u0440 \u0430\u0442\u0430\u043a\u0438 \u0441 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 (bring your own vulnerable driver - BYOVD). \u0414\u0430\u043d\u043d\u043e\u0439 \u0442\u0430\u043a\u0442\u0438\u043a\u043e\u0439 \u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044f BlackByte. \u0423\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044f \u0432 Windows \u0437\u0430\u043a\u043e\u043d\u043d\u044b\u0439, \u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 Micro-Star MSI Afterburner (RTCore64.sys), \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 (CVE-2019-16098, \u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 7,8) \u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u043b\u0438 \u0441\u043b\u0443\u0436\u0431\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\u00ab\u0422\u0435\u0445\u043d\u0438\u043a\u0430 \u0443\u043a\u043b\u043e\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0433\u043e \u0441\u043f\u0438\u0441\u043a\u0430 \u0438\u0437 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 1000 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u043e\u0432, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442\u0441\u044f \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0442\u044b\u00bb, \u2014 \u0441\u043a\u0430\u0437\u0430\u043b \u0432 \u043d\u043e\u0432\u043e\u043c \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u043e\u0431\u0437\u043e\u0440\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0443\u0433\u0440\u043e\u0437 Sophos \u0410\u043d\u0434\u0440\u0435\u0430\u0441 \u041a\u043b\u043e\u043f\u0448.\n\nBlackByte \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043d\u043e\u0432\u0435\u0439\u0448\u0435\u0435 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0442\u0435\u0445\u043d\u0438\u043a\u0443 BYOVD, \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e \u043c\u043e\u0434\u0435\u043b\u0438 randsom-as-a-service (Raas), \u0442\u043e \u0435\u0441\u0442\u044c \u043f\u0440\u0438\u043e\u0431\u0440\u0435\u0441\u0442\u0438 \u0433\u043e\u0442\u043e\u0432\u044b\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u043c\u043e\u0436\u0435\u0442 \u043b\u044e\u0431\u043e\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a. \u041a \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u043e\u0432 \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0433\u043e\u0434\u044b \u0432\u0441\u0435 \u0447\u0430\u0449\u0435 \u043f\u0440\u0438\u0431\u0435\u0433\u0430\u044e\u0442 \u043f\u0440\u043e\u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u0435 \u0433\u0440\u0443\u043f\u043f\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Slingshot, InvisiMole, APT28 \u0438 Lazarus.\n\n\u0414\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 BYOVD-\u0430\u0442\u0430\u043a \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u044b, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0438 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0442\u044c \u0438\u0445 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0438\u043b\u0438 \u0437\u0430\u043d\u043e\u0441\u0438\u0442\u044c \u0432 \u0447\u0435\u0440\u043d\u044b\u0439 \u0441\u043f\u0438\u0441\u043e\u043a \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u044b, \u043e \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e, \u0447\u0442\u043e \u043e\u043d\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://news.sophos.com/en-us/2022/10/04/blackbyte-ransomware-returns/ \n\n#BYOVD #BlackByte", "creation_timestamp": "2026-07-29T00:00:44.255827Z"}, {"uuid": "fdce025f-2163-46bc-8f89-1fc42a533d0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "seen", "source": "https://t.me/hacking_Attack/50153", "content": "KitPloit - PenTest Tools!\nEDRSandblast - Tool That Weaponize A Vulnerable Signed Driver To Bypass EDR Detections And LSASS Protections\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAMzRHxJsuayYfmlgYJ40ZPtgY0mQX_fJ-1XWkdNeiicxSAw8cPQ3Kig390B1yD2NgyUGLg6nsd-oF0MRo3JVR5j7pBbRbMB_bL7NEOi7hdPfYidDlrP7XFKEh3bkv4dbtgCSY3SSq_EN2IMa_YNmVs785PfHxb69R4MfBvxTSIJHc-WlEy6RC6lxi/w640-h314/EDRSandblast.png EDRSandBlastis a tool written in Cthat weaponize a vulnerable signed  driver to bypass EDR detections (Kernel callbacks and ETW TIprovider) and LSASSprotections. Multiple userland unhooking techniques are also  implemented to evade userland monitoring.\n\nAs of release, combination of userland (--usermode) and Kernel-land  (--kernelmode) techniques were used to dump LSASSmemory under EDR  scrutiny, without being blocked nor generating \"OS Credential Dumping\"-related  events in the product (cloud) console. The tests were performed on 3 distinct  EDR products and were successful in each case. DescriptionEDR bypass through Kernel callbacks removalEDR products use Kernel callbacks on Windows to be notified by the kernel of  system activity, such as process and thread creation and loading of images  (exe / DLL).\n\nThe Kernel callbacks are defined from user-land using a number of documented  APIs (nt!PsSetCreateProcessNotifyRoutine, nt!PsSetCreateThreadNotifyRoutine,  etc.). The user-land APIs add driver-supplied callback routines to undocumented  arrays of routines in Kernel-space:\n\n* PspCreateProcessNotifyRoutinefor process creation\n* PspCreateThreadNotifyRoutinefor thread creation\n* PspLoadImageNotifyRoutinefor image loading EDRSandBlastenumerates the routines defined in those arrays and remove any  callback routine linked to a predefined list of EDR drivers (more than 1000  thousands drivers of security products from the allocated filter altitudes).  The enumeration and removal are made possible through the exploitation of an  arbitrary Kernel memory read / write vulnerability of the Micro-Star MSI Afterburnerdriver (CVE-2019-16098). The enumeration and  removal code is largely inspired from br-sn's CheekyBlinder project.\n\nThe offsets of the aforementioned arrays are hardcoded in the NtoskrnlOffsets.csvfile for more than 350 versions of the Windows Kernel ntoskrnl.exe. The choice of going with hardcoded offsets instead of pattern  searches is justified by the fact that the undocumented APIs responsible for  Kernel callbacks addition / removal are subject to change and that any attempt  to write Kernel memory at the wrong address may (and often will) result in a Bug Check(Blue Screen of Death). For more information on how the offsets  were gathered, refer to Offsets section. EDR bypass through deactivation of the ETW Microsoft-Windows-Threat-Intelligence providerThe ETW Microsoft-Windows-Threat-Intelligenceprovider log data about the  usages of some Windows API commonly used maliciously. This include the nt!MiReadWriteVirtualMemoryAPI, called by nt!NtReadVirtualMemory(which is  used to dump LSASSmemory) and monitored by the nt!EtwTiLogReadWriteVmfunction.\n\nEDR products can consume the logs produced by the ETW TIprovider through  services or processes running as, respectively, SERVICE_LAUNCH_PROTECTED_ANTIMALWARE_LIGHTor PS_PROTECTED_ANTIMALWARE_LIGHT, and associated with an Early Launch Anti Malware (ELAM)driver.\n\nAs published by slaeryanin a CNO Development Labsblog post,  the ETW TIprovider can be disabled altogether by patching, i[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:43.954918Z"}, {"uuid": "25a0c01c-f3e4-4576-94e3-312050e4d895", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "seen", "source": "https://t.me/hacking_Attack/50136", "content": "Detection  From the defender (EDR vendor, Microsoft, SOC analysts looking at EDR's telemetry, ...) point of view, multiple indicators can be used to detect or prevent this kind of techniques.  Driver whitelisting  Since every action performed by the tool in kernel-mode memory relies on a vulnerable driver to read/write arbitrary content, driver loading events should be heaviliy scrutinized by EDR product (or SOC analysts), and raise an alert at any uncommon driver loading, or even block known vulnerable drivers. This latter approach is even recommended by Microsoft themselves (https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules): any HVCI (Hypervisor-protected code integrity) enabled Windows device embeds a drivers blocklist, and this will be progressively become a default behaviour on Windows (it already is on Windows 11).  Kernel-memory integrity checks  Since an attacker could still use an unknown vulnerable driver to perform the same actions in memory, the EDR driver could periodically check that its kernel callbacks are still registered, directly by inspecting kernel memory (like this tool does), or simply by triggering events (process creation, thread creation, image loading, etc.) and checking the callback functions are indeed called by the executive kernel.  As a side note, this type of data structure could be protected via the recent Kernel Data Protection (KDP) (https://www.microsoft.com/security/blog/2020/07/08/introducing-kernel-data-protection-a-new-platform-security-technology-for-preventing-data-corruption/) mechanism, which relies on Virtual Based Security, in order to make the kernel callbacks array non-writable without calling the right APIs.  The same logic could apply to sensitive ETW variables such as the ProviderEnableInfo, abused by this tool to disable the ETW Threat Intelligence (https://www.kitploit.com/search/label/Threat%20Intelligence) events generation.  User-mode detection  The first indicator that a process is actively trying to evade user-land hooking is the file accesses to each DLL corresponding to loaded modules; in a normal execution, a userland process rarely needs to read DLL files outside of a LoadLibrary call, especially ntdll.dll.  In order to protect API hooking from being bypassed, EDR products could periodically check that hooks are not altered in memory, inside each monitored process.  Finally, to detect hooking bypass (abusing a trampoline, using direct syscalls, etc.) that does not imply the hooks removal, EDR products could potentially rely on kernel callbacks associated to the abused syscalls (ex. PsCreateProcessNotifyRoutine for NtCreateProcess syscall, ObRegisterCallbacks for NtOpenProcess syscall, etc.), and perform user-mode call-stack analysis in order to determine if the syscall was triggered from a normal path (kernel32.dll -> ntdll.dll -> syscall) or an abnormal one (ex. program.exe -> direct syscall).  Acknowledgements      Kernel callbacks enumeration and removal:  https://github.com/br-sn/CheekyBlinder      Kernel memory Read / Write primitives through the vulnerable  Micro-Star MSI Afterburner driver:  https://github.com/Barakat/CVE-2019-16098/      Disabling of the ETW Threat Intelligence provider:  https://public.cnotools.studio/bring-your-own-vulnerable-kernel-driver-byovkd/exploits/data-only-attack-neutralizing-etwti-provider      Driver install / uninstall: https://github.com/gentilkiwi/mimikatz      Initial list of EDR drivers names:  https://github.com/SadProcessor/SomeStuff/blob/master/Invoke-EDRCheck.ps1      Credential Guard bypass by re-enabling Wdigest through LSASS memory  patching: https://teamhydra.blog/2020/08/25/bypassing-credential-guard/      Authors  Thomas DIOT (Qazeer) (https://github.com/Qazeer/)  Maxime MEIGNAN (themaks) (https://github.com/themaks)  Licence  CC BY 4.0 licence - https://creativecommons.org/licenses/by/4.0/\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:44.173464Z"}, {"uuid": "bde2e026-805e-4876-88eb-2633841e3d73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "seen", "source": "https://t.me/hacking_Attack/50153", "content": "KitPloit - PenTest Tools!\nEDRSandblast - Tool That Weaponize A Vulnerable Signed Driver To Bypass EDR Detections And LSASS Protections\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAMzRHxJsuayYfmlgYJ40ZPtgY0mQX_fJ-1XWkdNeiicxSAw8cPQ3Kig390B1yD2NgyUGLg6nsd-oF0MRo3JVR5j7pBbRbMB_bL7NEOi7hdPfYidDlrP7XFKEh3bkv4dbtgCSY3SSq_EN2IMa_YNmVs785PfHxb69R4MfBvxTSIJHc-WlEy6RC6lxi/w640-h314/EDRSandblast.png EDRSandBlastis a tool written in Cthat weaponize a vulnerable signed  driver to bypass EDR detections (Kernel callbacks and ETW TIprovider) and LSASSprotections. Multiple userland unhooking techniques are also  implemented to evade userland monitoring.\n\nAs of release, combination of userland (--usermode) and Kernel-land  (--kernelmode) techniques were used to dump LSASSmemory under EDR  scrutiny, without being blocked nor generating \"OS Credential Dumping\"-related  events in the product (cloud) console. The tests were performed on 3 distinct  EDR products and were successful in each case. DescriptionEDR bypass through Kernel callbacks removalEDR products use Kernel callbacks on Windows to be notified by the kernel of  system activity, such as process and thread creation and loading of images  (exe / DLL).\n\nThe Kernel callbacks are defined from user-land using a number of documented  APIs (nt!PsSetCreateProcessNotifyRoutine, nt!PsSetCreateThreadNotifyRoutine,  etc.). The user-land APIs add driver-supplied callback routines to undocumented  arrays of routines in Kernel-space:\n\n* PspCreateProcessNotifyRoutinefor process creation\n* PspCreateThreadNotifyRoutinefor thread creation\n* PspLoadImageNotifyRoutinefor image loading EDRSandBlastenumerates the routines defined in those arrays and remove any  callback routine linked to a predefined list of EDR drivers (more than 1000  thousands drivers of security products from the allocated filter altitudes).  The enumeration and removal are made possible through the exploitation of an  arbitrary Kernel memory read / write vulnerability of the Micro-Star MSI Afterburnerdriver (CVE-2019-16098). The enumeration and  removal code is largely inspired from br-sn's CheekyBlinder project.\n\nThe offsets of the aforementioned arrays are hardcoded in the NtoskrnlOffsets.csvfile for more than 350 versions of the Windows Kernel ntoskrnl.exe. The choice of going with hardcoded offsets instead of pattern  searches is justified by the fact that the undocumented APIs responsible for  Kernel callbacks addition / removal are subject to change and that any attempt  to write Kernel memory at the wrong address may (and often will) result in a Bug Check(Blue Screen of Death). For more information on how the offsets  were gathered, refer to Offsets section. EDR bypass through deactivation of the ETW Microsoft-Windows-Threat-Intelligence providerThe ETW Microsoft-Windows-Threat-Intelligenceprovider log data about the  usages of some Windows API commonly used maliciously. This include the nt!MiReadWriteVirtualMemoryAPI, called by nt!NtReadVirtualMemory(which is  used to dump LSASSmemory) and monitored by the nt!EtwTiLogReadWriteVmfunction.\n\nEDR products can consume the logs produced by the ETW TIprovider through  services or processes running as, respectively, SERVICE_LAUNCH_PROTECTED_ANTIMALWARE_LIGHTor PS_PROTECTED_ANTIMALWARE_LIGHT, and associated with an Early Launch Anti Malware (ELAM)driver.\n\nAs published by slaeryanin a CNO Development Labsblog post,  the ETW TIprovider can be disabled altogether by patching, i[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:55.788179Z"}, {"uuid": "edd938ed-34cf-4d6c-9e21-b51c0f7639f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "seen", "source": "https://t.me/hacking_Attack/50136", "content": "Detection  From the defender (EDR vendor, Microsoft, SOC analysts looking at EDR's telemetry, ...) point of view, multiple indicators can be used to detect or prevent this kind of techniques.  Driver whitelisting  Since every action performed by the tool in kernel-mode memory relies on a vulnerable driver to read/write arbitrary content, driver loading events should be heaviliy scrutinized by EDR product (or SOC analysts), and raise an alert at any uncommon driver loading, or even block known vulnerable drivers. This latter approach is even recommended by Microsoft themselves (https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules): any HVCI (Hypervisor-protected code integrity) enabled Windows device embeds a drivers blocklist, and this will be progressively become a default behaviour on Windows (it already is on Windows 11).  Kernel-memory integrity checks  Since an attacker could still use an unknown vulnerable driver to perform the same actions in memory, the EDR driver could periodically check that its kernel callbacks are still registered, directly by inspecting kernel memory (like this tool does), or simply by triggering events (process creation, thread creation, image loading, etc.) and checking the callback functions are indeed called by the executive kernel.  As a side note, this type of data structure could be protected via the recent Kernel Data Protection (KDP) (https://www.microsoft.com/security/blog/2020/07/08/introducing-kernel-data-protection-a-new-platform-security-technology-for-preventing-data-corruption/) mechanism, which relies on Virtual Based Security, in order to make the kernel callbacks array non-writable without calling the right APIs.  The same logic could apply to sensitive ETW variables such as the ProviderEnableInfo, abused by this tool to disable the ETW Threat Intelligence (https://www.kitploit.com/search/label/Threat%20Intelligence) events generation.  User-mode detection  The first indicator that a process is actively trying to evade user-land hooking is the file accesses to each DLL corresponding to loaded modules; in a normal execution, a userland process rarely needs to read DLL files outside of a LoadLibrary call, especially ntdll.dll.  In order to protect API hooking from being bypassed, EDR products could periodically check that hooks are not altered in memory, inside each monitored process.  Finally, to detect hooking bypass (abusing a trampoline, using direct syscalls, etc.) that does not imply the hooks removal, EDR products could potentially rely on kernel callbacks associated to the abused syscalls (ex. PsCreateProcessNotifyRoutine for NtCreateProcess syscall, ObRegisterCallbacks for NtOpenProcess syscall, etc.), and perform user-mode call-stack analysis in order to determine if the syscall was triggered from a normal path (kernel32.dll -> ntdll.dll -> syscall) or an abnormal one (ex. program.exe -> direct syscall).  Acknowledgements      Kernel callbacks enumeration and removal:  https://github.com/br-sn/CheekyBlinder      Kernel memory Read / Write primitives through the vulnerable  Micro-Star MSI Afterburner driver:  https://github.com/Barakat/CVE-2019-16098/      Disabling of the ETW Threat Intelligence provider:  https://public.cnotools.studio/bring-your-own-vulnerable-kernel-driver-byovkd/exploits/data-only-attack-neutralizing-etwti-provider      Driver install / uninstall: https://github.com/gentilkiwi/mimikatz      Initial list of EDR drivers names:  https://github.com/SadProcessor/SomeStuff/blob/master/Invoke-EDRCheck.ps1      Credential Guard bypass by re-enabling Wdigest through LSASS memory  patching: https://teamhydra.blog/2020/08/25/bypassing-credential-guard/      Authors  Thomas DIOT (Qazeer) (https://github.com/Qazeer/)  Maxime MEIGNAN (themaks) (https://github.com/themaks)  Licence  CC BY 4.0 licence - https://creativecommons.org/licenses/by/4.0/\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:57.012749Z"}, {"uuid": "4748b214-38ce-4dff-8a62-3b5461d5d874", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/50136", "content": "Detection  From the defender (EDR vendor, Microsoft, SOC analysts looking at EDR's telemetry, ...) point of view, multiple indicators can be used to detect or prevent this kind of techniques.  Driver whitelisting  Since every action performed by the tool in kernel-mode memory relies on a vulnerable driver to read/write arbitrary content, driver loading events should be heaviliy scrutinized by EDR product (or SOC analysts), and raise an alert at any uncommon driver loading, or even block known vulnerable drivers. This latter approach is even recommended by Microsoft themselves (https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules): any HVCI (Hypervisor-protected code integrity) enabled Windows device embeds a drivers blocklist, and this will be progressively become a default behaviour on Windows (it already is on Windows 11).  Kernel-memory integrity checks  Since an attacker could still use an unknown vulnerable driver to perform the same actions in memory, the EDR driver could periodically check that its kernel callbacks are still registered, directly by inspecting kernel memory (like this tool does), or simply by triggering events (process creation, thread creation, image loading, etc.) and checking the callback functions are indeed called by the executive kernel.  As a side note, this type of data structure could be protected via the recent Kernel Data Protection (KDP) (https://www.microsoft.com/security/blog/2020/07/08/introducing-kernel-data-protection-a-new-platform-security-technology-for-preventing-data-corruption/) mechanism, which relies on Virtual Based Security, in order to make the kernel callbacks array non-writable without calling the right APIs.  The same logic could apply to sensitive ETW variables such as the ProviderEnableInfo, abused by this tool to disable the ETW Threat Intelligence (https://www.kitploit.com/search/label/Threat%20Intelligence) events generation.  User-mode detection  The first indicator that a process is actively trying to evade user-land hooking is the file accesses to each DLL corresponding to loaded modules; in a normal execution, a userland process rarely needs to read DLL files outside of a LoadLibrary call, especially ntdll.dll.  In order to protect API hooking from being bypassed, EDR products could periodically check that hooks are not altered in memory, inside each monitored process.  Finally, to detect hooking bypass (abusing a trampoline, using direct syscalls, etc.) that does not imply the hooks removal, EDR products could potentially rely on kernel callbacks associated to the abused syscalls (ex. PsCreateProcessNotifyRoutine for NtCreateProcess syscall, ObRegisterCallbacks for NtOpenProcess syscall, etc.), and perform user-mode call-stack analysis in order to determine if the syscall was triggered from a normal path (kernel32.dll -> ntdll.dll -> syscall) or an abnormal one (ex. program.exe -> direct syscall).  Acknowledgements      Kernel callbacks enumeration and removal:  https://github.com/br-sn/CheekyBlinder      Kernel memory Read / Write primitives through the vulnerable  Micro-Star MSI Afterburner driver:  https://github.com/Barakat/CVE-2019-16098/      Disabling of the ETW Threat Intelligence provider:  https://public.cnotools.studio/bring-your-own-vulnerable-kernel-driver-byovkd/exploits/data-only-attack-neutralizing-etwti-provider      Driver install / uninstall: https://github.com/gentilkiwi/mimikatz      Initial list of EDR drivers names:  https://github.com/SadProcessor/SomeStuff/blob/master/Invoke-EDRCheck.ps1      Credential Guard bypass by re-enabling Wdigest through LSASS memory  patching: https://teamhydra.blog/2020/08/25/bypassing-credential-guard/      Authors  Thomas DIOT (Qazeer) (https://github.com/Qazeer/)  Maxime MEIGNAN (themaks) (https://github.com/themaks)  Licence  CC BY 4.0 licence - https://creativecommons.org/licenses/by/4.0/\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:12.922179Z"}, {"uuid": "10c98711-c357-4899-980c-035a042bcd53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/50153", "content": "KitPloit - PenTest Tools!\nEDRSandblast - Tool That Weaponize A Vulnerable Signed Driver To Bypass EDR Detections And LSASS Protections\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAMzRHxJsuayYfmlgYJ40ZPtgY0mQX_fJ-1XWkdNeiicxSAw8cPQ3Kig390B1yD2NgyUGLg6nsd-oF0MRo3JVR5j7pBbRbMB_bL7NEOi7hdPfYidDlrP7XFKEh3bkv4dbtgCSY3SSq_EN2IMa_YNmVs785PfHxb69R4MfBvxTSIJHc-WlEy6RC6lxi/w640-h314/EDRSandblast.png EDRSandBlastis a tool written in Cthat weaponize a vulnerable signed  driver to bypass EDR detections (Kernel callbacks and ETW TIprovider) and LSASSprotections. Multiple userland unhooking techniques are also  implemented to evade userland monitoring.\n\nAs of release, combination of userland (--usermode) and Kernel-land  (--kernelmode) techniques were used to dump LSASSmemory under EDR  scrutiny, without being blocked nor generating \"OS Credential Dumping\"-related  events in the product (cloud) console. The tests were performed on 3 distinct  EDR products and were successful in each case. DescriptionEDR bypass through Kernel callbacks removalEDR products use Kernel callbacks on Windows to be notified by the kernel of  system activity, such as process and thread creation and loading of images  (exe / DLL).\n\nThe Kernel callbacks are defined from user-land using a number of documented  APIs (nt!PsSetCreateProcessNotifyRoutine, nt!PsSetCreateThreadNotifyRoutine,  etc.). The user-land APIs add driver-supplied callback routines to undocumented  arrays of routines in Kernel-space:\n\n* PspCreateProcessNotifyRoutinefor process creation\n* PspCreateThreadNotifyRoutinefor thread creation\n* PspLoadImageNotifyRoutinefor image loading EDRSandBlastenumerates the routines defined in those arrays and remove any  callback routine linked to a predefined list of EDR drivers (more than 1000  thousands drivers of security products from the allocated filter altitudes).  The enumeration and removal are made possible through the exploitation of an  arbitrary Kernel memory read / write vulnerability of the Micro-Star MSI Afterburnerdriver (CVE-2019-16098). The enumeration and  removal code is largely inspired from br-sn's CheekyBlinder project.\n\nThe offsets of the aforementioned arrays are hardcoded in the NtoskrnlOffsets.csvfile for more than 350 versions of the Windows Kernel ntoskrnl.exe. The choice of going with hardcoded offsets instead of pattern  searches is justified by the fact that the undocumented APIs responsible for  Kernel callbacks addition / removal are subject to change and that any attempt  to write Kernel memory at the wrong address may (and often will) result in a Bug Check(Blue Screen of Death). For more information on how the offsets  were gathered, refer to Offsets section. EDR bypass through deactivation of the ETW Microsoft-Windows-Threat-Intelligence providerThe ETW Microsoft-Windows-Threat-Intelligenceprovider log data about the  usages of some Windows API commonly used maliciously. This include the nt!MiReadWriteVirtualMemoryAPI, called by nt!NtReadVirtualMemory(which is  used to dump LSASSmemory) and monitored by the nt!EtwTiLogReadWriteVmfunction.\n\nEDR products can consume the logs produced by the ETW TIprovider through  services or processes running as, respectively, SERVICE_LAUNCH_PROTECTED_ANTIMALWARE_LIGHTor PS_PROTECTED_ANTIMALWARE_LIGHT, and associated with an Early Launch Anti Malware (ELAM)driver.\n\nAs published by slaeryanin a CNO Development Labsblog post,  the ETW TIprovider can be disabled altogether by patching, i[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:13.193080Z"}]}