Microsoft is developing the Windows 11 27H2 update, focusing on core system stability, new wallpapers, and 64-bit speed via Intel APX register expansion.
Related Posts:
Windows 11 Cloud Rebuild Delivers Fresh System Recovery
Windows 11 Android Apps Return via Taskbar Search
Windows 11 Speed Test Tool Arrives as Native Utility
The post Windows 11 27H2 Update Brings Intel APX Boost appeared first on Daily CyberSecurity.
Microsoft is developing the Windows 11 27H2 update, focusing on core system stability, new wallpapers, and 64-bit speed via Intel APX register expansion.
Microsoft launches Windows 11 Cloud Rebuild, a native recovery tool that downloads fresh system images and drivers directly from the cloud without USB media.
Related Posts:
Windows 11 27H2 Update Brings Intel APX Boost
Windows 11 Android Apps Return via Taskbar Search
Windows 11 Speed Test Tool Arrives as Native Utility
The post Windows 11 Cloud Rebuild Delivers Fresh System Recovery appeared first on Daily CyberSecurity.
Microsoft launches Windows 11 Cloud Rebuild, a native recovery tool that downloads fresh system images and drivers directly from the cloud without USB media.
Microsoft revives Windows 11 Android apps integration via Phone Link and taskbar search, streaming mobile software directly from compatible devices.
Related Posts:
Windows 11 Speed Test Tool Arrives as Native Utility
Windows 11 26H2 Upgrade Expands to Windows 10 Users
Windows CLAT IPv6 Support Arrives in Windows 11
The post Windows 11 Android Apps Return via Taskbar Search appeared first on Daily CyberSecurity.
A new XLoader infection chain. It hides the credential stealer inside an embedded LuaJIT interpreter. It moves it into another Windows process through shared-section injection. The campaign uses business-themed email lures. It also delivered Agent Tesla, Remcos and XWorm . The chain starts with order and payment emails. One Greek-language message has a subject starting […]
The post Hackers Abuse LuaJIT and Windows Process Injection to Hide XLoader Credential-Stealing Malware appeared first on GB
A new XLoader infection chain. It hides the credential stealer inside an embedded LuaJIT interpreter. It moves it into another Windows process through shared-section injection. The campaign uses business-themed email lures. It also delivered Agent Tesla, Remcos and XWorm . The chain starts with order and payment emails. One Greek-language message has a subject starting […]
Microsoft introduces a native Windows 11 speed test tool developed with AI agents, measuring network latency, download rates, and upload performance.
Related Posts:
Windows 11 26H2 Upgrade Expands to Windows 10 Users
Windows CLAT IPv6 Support Arrives in Windows 11
Windows 11 Prefetch Files: Performance and Forensics
The post Windows 11 Speed Test Tool Arrives as Native Utility appeared first on Daily CyberSecurity.
Microsoft expands the Windows 11 26H2 upgrade rollout to eligible Windows 10 PCs, offering optional full feature updates via Windows Update.
Related Posts:
Windows 11 Speed Test Tool Arrives as Native Utility
Windows CLAT IPv6 Support Arrives in Windows 11
Windows 11 Prefetch Files: Performance and Forensics
The post Windows 11 26H2 Upgrade Expands to Windows 10 Users appeared first on Daily CyberSecurity.
A public proof-of-concept exploit for CVE-2023-21768 shows how attackers with local access can gain SYSTEM privileges through the Windows Ancillary Function Driver for WinSock.
Researchers Valentina Palmiotti, known as chompie, and Ruben Boonen published the code. Their complete exploit targets vulnerable Windows 11 22H2 systems.
The release concerns a vulnerability patched in January 2023, not a newly disclosed Windows flaw. IBM published the researchers’ technical analysis on March 21, 2
A public proof-of-concept exploit for CVE-2023-21768 shows how attackers with local access can gain SYSTEM privileges through the Windows Ancillary Function Driver for WinSock.
Researchers Valentina Palmiotti, known as chompie, and Ruben Boonen published the code. Their complete exploit targets vulnerable Windows 11 22H2 systems.
The release concerns a vulnerability patched in January 2023, not a newly disclosed Windows flaw. IBM published the researchers’ technical analysis on March 21, 2023.
The vulnerability carries a CVSS score of 7.8 and requires low-level local privileges, with no user interaction. It does not provide a direct route into a computer over the internet. The flaw sits in afd.sys, a Windows kernel driver that handles requests from the WinSock networking interface.
According to IBM’s technical analysis, the researchers compared driver versions from December 2022 and January 2023 to understand Microsoft’s fix. Only one function, AfdNotifyRemoveIoCompletion, appeared to have changed, helping them narrow their investigation.
The older code failed to check a memory pointer supplied from a user application. That missing check let a local attacker write to kernel memory, where Windows stores sensitive system data.
Microsoft’s updated code added validation to ensure that pointers from user mode reference suitable user-space memory rather than protected kernel addresses.
POC for Windows WinSock Ancillary Vulnerability
The researchers said they diagnosed, reproduced, and turned the flaw into a working exploit in about one day, despite having no previous experience with this driver.
Their findings show how comparing patched and unpatched software can reveal enough detail to build an attack quickly.
The public GitHub repository describes the code as a demonstration. Its complete privilege escalation chain works on vulnerable Windows 11 22H2 installations, while the underlying memory-write capability works across vulnerable systems.
These are separate claims, and the repository does not promise full exploit compatibility with every affected Windows version. To move from a limited memory write to broader control, the exploit changes Windows I/O ring objects. These objects support queued input and output work.
The technique builds on research by Yarden Shafir and enables kernel memory reads and writes. The exploit then replaces a target process’s security token with one carrying SYSTEM privileges.
IBM also reported that 360 IceSword Lab found a different exploit in the wild in January 2023. That sample used the ProcessSocketNotifications interface rather than the researchers’ direct driver approach. This report does not establish that attackers used the published GitHub code.
Administrators should verify that affected devices received Microsoft’s fix or later applicable updates. IBM’s demonstration also worked without being blocked by HVCI, showing why that protection should not replace patching.
Fake Adobe Acrobat pages distribute signed ScreenConnect installers configured for attacker-controlled remote access to Windows PCs, CloudSEK’s researchers say.
Fake Adobe Acrobat pages distribute signed ScreenConnect installers configured for attacker-controlled remote access to Windows PCs, CloudSEK’s researchers say.
Microsoft has resolved an issue in Windows 11 that prevented non-administrator users from connecting to devices with Administrator protection enabled. This fix was included in KB5127936, released on October 28, 2026, and is part of subsequent updates. While this issue is urgent for affected organizations, Microsoft has categorized the release as a preview update rather […]
The post Microsoft Releases Emergency Fix for Windows 11 Remote Desktop Connection Failures appeared first on GBHackers Secu
Microsoft has resolved an issue in Windows 11 that prevented non-administrator users from connecting to devices with Administrator protection enabled. This fix was included in KB5127936, released on October 28, 2026, and is part of subsequent updates. While this issue is urgent for affected organizations, Microsoft has categorized the release as a preview update rather […]
Microsoft explains why deleting Windows 11 Prefetch files degrades application startup performance while highlighting their crucial digital forensics role.
Related Posts:
Windows 11 CTL Update Refreshes Offline Certificates
Windows 11 Universal Print Glitch Demands Manual Fix
Intel APX Windows 11 Toggle Unlocks CPU Efficiency
The post Windows 11 Prefetch Files: Performance and Forensics appeared first on Daily CyberSecurity.
Microsoft explains why deleting Windows 11 Prefetch files degrades application startup performance while highlighting their crucial digital forensics role.
Microsoft has released an emergency Windows update to remove trust in certificates associated with compromised eMudhra certificate authority keys. The out-of-band update, issued on October 26, 2026, eliminates seven certificates from the Windows trust list. Following this, the same removals were applied to Microsoft Edge on October 27, as stated by the Microsoft Security Response […]
The post Microsoft Releases Emergency Windows Updates to Revoke Trust in Compromised eMudhra Certificates appeare
Microsoft has released an emergency Windows update to remove trust in certificates associated with compromised eMudhra certificate authority keys. The out-of-band update, issued on October 26, 2026, eliminates seven certificates from the Windows trust list. Following this, the same removals were applied to Microsoft Edge on October 27, as stated by the Microsoft Security Response […]
Attackers are compromising camera management software to gain remote access, run malicious DLLs through a legitimate Windows component, and maintain persistent footholds in enterprise environments. The incidents show how overlooked surveillance applications can become entry points into broader corporate networks. Huntress observed several intrusions during September and October involving CMS.exe, a camera management application installed […]
The post Hackers Hijack Camera Management Software to
Attackers are compromising camera management software to gain remote access, run malicious DLLs through a legitimate Windows component, and maintain persistent footholds in enterprise environments. The incidents show how overlooked surveillance applications can become entry points into broader corporate networks. Huntress observed several intrusions during September and October involving CMS.exe, a camera management application installed […]
Microsoft released a Windows 11 CTL update to refresh offline certificate trust lists and remove untrusted roots across air-gapped enterprise systems.
Related Posts:
Windows 11 Universal Print Glitch Demands Manual Fix
Intel APX Windows 11 Toggle Unlocks CPU Efficiency
Windows 11 Speed Test Gets Native Tool Integration
The post Windows 11 CTL Update Refreshes Offline Certificates appeared first on Daily CyberSecurity.
A persistent Windows 11 Universal Print bug breaks printer queues after OS upgrades, displaying error 0x80004005 and requiring queue reinstallation.
Related Posts:
Windows 11 CTL Update Refreshes Offline Certificates
Intel APX Windows 11 Toggle Unlocks CPU Efficiency
Windows 11 Speed Test Gets Native Tool Integration
The post Windows 11 Universal Print Glitch Demands Manual Fix appeared first on Daily CyberSecurity.
Microsoft tests an Intel APX Windows 11 performance toggle in preview builds, doubling general-purpose registers for enhanced processor speed.
Related Posts:
Windows 11 CTL Update Refreshes Offline Certificates
Windows 11 Universal Print Glitch Demands Manual Fix
Windows 11 Speed Test Gets Native Tool Integration
The post Intel APX Windows 11 Toggle Unlocks CPU Efficiency appeared first on Daily CyberSecurity.
Microsoft is testing a native Windows 11 speed test tool in preview builds, replacing web browser redirections with an integrated Ookla utility.
Related Posts:
Windows Server 2025 Gains Quick Machine Recovery
Windows 11 Accelerated Launch Speeds Up Edge Startup
Windows 11 Update Triggers Xbox Live Error 0x87DD0005
The post Windows 11 Speed Test Gets Native Tool Integration appeared first on Daily CyberSecurity.
The Arc browser shutdown arrives December 22, 2026. Export your data now and move to Dia before accounts are deleted.
Related Posts:
iOS 27.1 iPhone Duo Release Targets Foldable Hardware
OpenAI Cuts Internet Access for Frontier Model Training
Google Privacy Policy Change Raises Gmail Ad Concerns
The post Arc Browser Shutdown Set for December 22, 2026 appeared first on Daily CyberSecurity.
Introduction
Back in October 2022, Kaspersky GReAT was looking into a peculiar advertisement on a hacking forum. A cybercriminal had been advertising a UEFI bootkit, dubbed BlackLotus, that could bypass Secure Boot, for $5,000. Given the low price for such powerful capabilities, the cybersecurity community initially took this advertisement with a grain of salt. As no BlackLotus samples were found in the wild, no one could at the time verify the claims made in the forum post.
BlackLotus advertise
Back in October 2022, Kaspersky GReAT was looking into a peculiar advertisement on a hacking forum. A cybercriminal had been advertising a UEFI bootkit, dubbed BlackLotus, that could bypass Secure Boot, for $5,000. Given the low price for such powerful capabilities, the cybersecurity community initially took this advertisement with a grain of salt. As no BlackLotus samples were found in the wild, no one could at the time verify the claims made in the forum post.
BlackLotus advertisement
However, about half a year later, in March 2023, ESET confirmed that the BlackLotus advertisement was genuine. The researchers tracked down samples of this bootkit and confirmed that it can indeed bypass Secure Boot through a vulnerability called Baton Drop (CVE-2022-21894). As this vulnerability was still exploitable in 2023, Microsoft had to release multiple security updates to address it.
Since the release of these updates, the BlackLotus bootkit has gone quiet — no publicly known attacks have used it. Yet in early 2026, we discovered a malware sample similar to BlackLotus that was used in an APT campaign in Central Asia. In this report, we share our findings, including new payloads and possible attribution of this campaign.
The return of the infamous bootkit
In early 2026 we identified a complex APT attack targeting diplomatic agencies in Central Asian countries — namely Tajikistan, Uzbekistan, and Turkmenistan. This attack involved a UEFI bootkit that we dubbed BlackX. Having examined it, we found it to be similar to BlackLotus.
Attackers have been deploying BlackX after compromising the victim machine networks and obtaining administrator privileges. To install the bootkit, we observed them dropping the following files:
inst.exe, an installer executable
PVMDIJGKAX2, an RC4-encrypted extensionless file containing files and strings required for the installation
The installer was launched with the command line C:\ProgramData\Intel\inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1. The last argument here is the RC4 key used for decryption.
Curiously, the file inst.exe does not contain any malicious strings or embedded blobs. All the files needed to install the malicious payload are inside PVMDIJGKAX2, which makes it harder for incident responders to retrieve the bootkit components.
The installer package drops a set of files to both system and UEFI partitions, designed to exploit the Baton Drop vulnerability. We noted that the implementation of the exploit is remarkably similar to the one used in the BlackLotus malware. As with BlackLotus, the goal of the exploit is to install custom Machine Owner Keys (MOK), which allows loading arbitrary EFI files on the target machines to manipulate Secure Boot.
While the vulnerability exploitation chain was implemented very similarly to BlackLotus, we spotted differences between the exploits in BlackLotus and BlackX. That said, the source code of the BlackLotus bootkit has never been published online. This could mean that the attackers behind BlackX either reverse-engineered the BlackLotus bootkit or purchased its source code from cybercriminals. Either way, this is an interesting observation, as we rarely see APT actors borrow ideas or code from cybercrime actors.
Payload launched by the bootkit
The UEFI payload delivered during the Baton Drop exploitation has a classic bootkit goal — to inject a malicious driver into the Windows kernel. This driver differs from the one deployed by BlackLotus and is signed with a certificate belonging to an organization named 温江区明宇网络技术服务工作室 (English: Wenjiang District Mingyu Network Technology Service Studio). At the time of writing, this certificate (serial number: 0bcdf5e0da32d68900b8b7638459d072) has been revoked by its issuer.
The driver aims to tamper with security solutions installed on the machine. For example, it disables process, thread, and registry callbacks related to security solutions. It also tampers with ETW providers so that security solutions cannot access their output. Curiously, some of the tampering procedures are designed to run only if Kaspersky or Avast solutions are installed on the infected machine. However, during dynamic analysis of this driver, we found that these procedures are useless — they fail to interfere with Kaspersky products in any way.
The driver also protects the bootkit’s files from tampering. It intercepts kernel requests to open these files and returns a handle to calc.exe instead of a malicious file handle.
User-mode second-stage payloads
Apart from tampering with security solutions, the driver also deploys a user-mode payload. We observed two such payloads, used for cyberespionage, in the wild. One of them is a RAT that can load further-stage .NET payloads. This RAT uses cloud storage for C2 server communications — we observed its versions using Google Drive, OneDrive, and Yandex.Disk. Having connected to a cloud storage service, this RAT iterates over files available there and interprets them depending on the file suffix. Below is a list of supported suffixes:
File suffix
Description
Type
0X01
A .NET file. The task is to parse it and run the method TEST.Class1.RunCMD(argument_array) from the module
Input
0X02
Result of the call TEST.Class1.RunCMD(argument_array)
Output
0X03
Task to upload a file to the drive
Input
0X04
Uploaded file
Output
0X05
Task to download a file to an infected machine
Input
0X06
File download status
Output
SSSR
Contains initial system info
Output
We also observed another payload delivered through the bootkit, which we dubbed OxiDLLRunner. It is a malicious DLL obfuscated with OLLVM. It is loaded by the legitimate file googleupdate.exe (original filename: jcef_helper.exe, MD5: AF8A983B9ADA07EAE1259BF2953ABD40), which is also delivered by the bootkit. The DLL decrypts the contents of the file v8_context_snapshot.bin, which resides in the same folder, and then jumps to the beginning of the decrypted content. The decrypted data starts with shellcode followed by a PE file, which is a Rust payload designed to communicate with the www[.]archivetj[.]com C2 server. During communication, this payload is supposed to receive DLL files exporting a function named create_plugin, which are then executed in separate threads.
Attribution
Based on the following facts, we have attributed this attack to the APT41 threat actor with medium confidence:
In June 2026, ESET published a blog post on attacks by the FishMonger threat actor, which the community assumes to be related to APT41. This post describes a kernel implant with a PDB path starting with C:\Users\xdd\Desktop. While describing the campaign, the post also suggests the possible use of an unspecified UEFI bootkit component, which might exploit CVE‑2023‑24932. We observed the identifier “xdd” used multiple times in the BlackX bootkit payloads, so we assess that BlackX is the UEFI bootkit referenced in the ESET blog post;
The payloads deployed by BlackX are loaded using a legitimate executable abused via DLL sideloading, and an encrypted file — this pattern is common among Chinese-speaking threat actors;
The OxiDLLRunner file has been obfuscated with OLLVM, an obfuscator commonly used by Chinese-speaking actors.
Why did the target organizations get infected?
During our initial analysis of BlackX, we thought that attackers succeeded in deploying it due to the negligence of the target organizations. Baton Drop, the vulnerability used to deploy BlackX, was disclosed back in 2023 and was patched, so we first thought that the infected machines lacked the relevant updates. However, our investigation proved this wrong — the targeted machines were fully patched.
Instead, we found out that the problem was with the patch itself. As it turned out, the patch for the Baton Drop vulnerability is designed to revoke the “Windows Production PCA 2011” certificate used to sign vulnerable UEFI components. However, this revocation does not happen automatically upon patch installation — the user has to trigger it manually. This is done with the following steps:
A registry flag is set inside HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot;
A scheduled task named Secure-Boot-Update is created.
This patch is designed to be applied manually — for instance, applying it automatically could break dual-boot systems relying on the “Windows Production PCA 2011” certificate to load. At the same time, this patch deployment practice creates a problem — as it is extremely unusual for a system administrator to take extra steps after installing an update. Usually, when applying patches, system administrators take no further action unless an installation failure occurs. These instructions for activating the patch are buried deep on the Microsoft website, and we assess that they are quite hard for an average IT administrator to notice.
Curiously, Microsoft’s plan for deploying the Baton Drop patches mentions an “Enforcement Phase” that involves revoking the “Windows Production PCA 2011” certificate automatically, without user interaction. At the time of publishing this post, this stage has not been implemented. On October 19, 2026, this certificate expired, but this does not prevent the vulnerable binaries from loading unless the certificate is blocklisted.
It is likely that the threat actor behind this campaign took into account that few organizations realized the importance of manually activating the Baton Drop patch. As such, we believe they decided to invest time in understanding how BlackLotus works and creating a copycat of this bootkit.
Conclusion
Patch management is important for every organization, as updates from vendors help protect software and hardware against known vulnerabilities. However, sometimes installed patches fail to protect against the flaws they address. The BlackLotus story we described is not the only such example — for instance, in 2025 Microsoft released an update against the ToolShell vulnerability that also had to be applied manually.
However, modern security solutions are designed to account for such cases when installed patches fail to protect against security flaws for one reason or another. For instance, the Exploit Prevention component available in Kaspersky products prevents exploits from running if the patch is not applied, or if it is a zero-day vulnerability with no available patch. It is thus crucial to equip all machines in an organization with security solutions and constantly monitor the alerts they raise.
Entrar
