Friday 26 June 2026 09:13:35 GMT+02:00
Netcrook
#EDR bypass
Ghost Frames Turns the Endpoint’s Own Memory of Itself Into the Weak Link
A reported call-stack manipulation technique puts a rare kind of pressure on EDR: if the stack can be made to look normal, one of its best context signals can become less useful.
A Ransomware Brand With Old Habits and New Evasion Tricks
Payouts King is being described as a post-BlackBasta threat that pairs social engineering overlap with code designed to frustrate some endpoint defenses.
When the Startup Path Becomes the Attack Path
A reported .NET abuse chain shows how defenders can lose visibility before an application fully settles, especially when startup manipulation is paired with DLL sideloading and recruitment-themed lures.
When Signed Drivers Become the Weapon: The BYOVD Path into Ransomware
A Windows trust mechanism meant to protect endpoints can be turned against them, letting attackers use vulnerable drivers to undermine security controls before ransomware takes hold.