Signed Drivers Turn Into Attack Tools

This week's threat landscape shows attackers leaning on the things systems are built to trust. Signed drivers get repurposed against endpoint defenses. Legitimate applications help malware hide in plain sight. A weak header check opens a route to code execution. And exposed systems, lingering bugs, odd concealment tricks, and AI-assisted research keep making it easier to cause damage.

The gaps are small, but they're doing a lot of work. Here's what stood out.

Weaponizing Microsoft's Signed Driver

Researchers at Check Point have reverse engineered Microsoft Defender's Boot-Time Removal driver, known as BTR.sys, and shown that it can be repurposed as a universal kernel operation engine. The technique exploits a window between system startup and user mode initialization, letting an attacker bypass endpoint security without relying on the typical bring-your-own-vulnerable-driver (BYOVD) method.

Because the driver is a legitimate Microsoft-signed component, signature-based blocking doesn't catch it. The researchers also noted that a weaponization tool like BTR_CLI deliberately mimics the operational footprint of the legitimate Windows Defender remediation process. That makes detection harder for tools that look for unusual behavior.

Because BTR.sys is a legitimate Microsoft-signed component, signature-based blocking is ineffective. Furthermore, a well-crafted weaponization tool (like BTR_CLI) intentionally mimics the operational footprint of the legitimate Windows Defender remediation process.

— Jiří Vinopal, security researcher at Check Point

Iranian Hackers Charged in Long-Running Theft

The U.S. Department of Justice charged 17 members of the Mabna Institute, an Iran-based company, for a coordinated campaign of cyber intrusions that ran from around 2013 through at least December 2017. The targets included 144 U.S. universities, 178 foreign universities, at least 42 U.S. private sector companies, and several government agencies.

According to the DoJ, the Mabna Institute stole more than 31 TB of academic data and intellectual property, as well as email accounts from private companies, government agencies, and NGOs. The operation targeted over 100,000 professor accounts worldwide and successfully compromised roughly 8,000 of them. The intrusions were carried out on behalf of Iran's Islamic Revolutionary Guard Corps (IRGC).

The group also sold stolen data through two websites, Megapaper.ir and Gigapaper.ir. The U.S. Department of State is offering a $10 million reward for information about five of the defendants or associated individuals and entities.

Grandoreiro Goes North to Mexico

New research from Acronis has found a Grandoreiro malware campaign abusing the legitimate Duplicate Files Finder (DFF) application to run malicious code via DLL sideloading. Telemetry data shows activity concentrated in Latin America, with Mexico, Spain, Peru, and Argentina accounting for most infections.

The initial sample includes extensive anti-analysis functionality, including sandbox detection, virtual machine artifact checks, process blacklisting, and environment profiling. Acronis noted these checks occur before any attempt to contact the command-and-control (C2) infrastructure, suggesting the operators prioritize avoiding analysis.

ClickFix Meets BYOVD in New Campaign

ErrTraffic-generated ClickFix campaigns have been observed delivering Cruciferra, which uses a legitimate but vulnerable driver called DCRCVDrv.sys in a BYOVD attack to escalate privileges and terminate security processes. ErrTraffic is a malware-as-a-service (MaaS) framework and traffic distribution system (TDS) sold by a threat actor known as LenAI.

It distributes threats through compromised WordPress websites, ClickFix social engineering, and EtherHiding. In recent months, ErrTraffic has delivered Remus Stealer, Vidar Stealer, Okobot, LegionLoader, OnionDrop-related payloads, and BabaDedaLoader, according to WatchGuard. The final payload in this campaign is Remus Stealer, launched via process hollowing.

eSentire described the attack chain: victims land on compromised WordPress sites injected with an obfuscated ErrTraffic-generated JavaScript loader. The loader resolves its C2 domain by querying a Polygon smart contract, then sends a request to the C2 to retrieve the next stage, which serves a ClickFix lure.

OpenAI, Google Push Privacy-Preserving AI

OpenAI has announced a privacy-focused approach to monitoring model misuse, called Private Safety Processing. The company is previewing the service to select customers, promising that for zero data retention (ZDR) deployments, customer content stays on infrastructure the customer controls. OpenAI is also developing an option where content is stored on OpenAI infrastructure but encrypted with keys controlled by the customer.

Automated systems can identify potential misuse and return limited safety signals without exposing underlying prompts or responses to OpenAI personnel. The move appears to target Anthropic, which has a 30-day retention policy for business customers using its Mythos-class models.

In a related development, Google showcased HEIR, the Homomorphic Encryption Intermediate Representation, an open-source compiler toolchain for homomorphic encryption that can convert pre-trained AI models to operate on encrypted inputs, enabling cryptographically secure private AI inference.

Kriminal AI: No Guardrails, On the Clearnet

A new AI-powered service called Kriminal AI offers paying customers answers without filters or guardrails. The website claims to have more than 2,300 users. Subscriptions start at $12.99/month and go up to $99.00/month. Unlike similar tools that lurk on the dark web, Kriminal AI is accessible on the clearnet.

ThreatDown reports the service appears to use Grok for primary inference, Google Cloud and Cloudflare for hosting, Anthropic's Claude for a long-context model layer, Llama routed through OpenRouter for specialized tasks, Tavily for live search, NowPayments for crypto checkout (no KYC), and Cloudflare/Let's Encrypt for DNS and TLS.

It follows WormGPT, FraudGPT, and Xanthorox into a fast-growing market for users frustrated by safety measures in mainstream models.

Apple's ATT Changes in Germany

Apple has agreed to changes to its App Tracking Transparency (ATT) feature in Germany after the Federal Cartel Office (FCO) found it gave Apple's own apps more favorable consent prompts than third-party developers. Apple has four months to implement the changes, which will apply in almost all European Union countries.

The FCO said the differences in consent requests exceeded what could be justified. The wording, design, and selection options for Apple's own offerings encouraged users to give consent, while discouraging it for third-party apps. In some cases, third-party apps had to request consent multiple times even after compliant consent.

This follows a €98.6 million fine (then $116 million) imposed by Italy's antitrust authority in December 2025 over ATT's impact on App Store competition.

Flaws in Refrigeration Controllers

Claroty's Team82 found 23 vulnerabilities in Copeland XWEB Pro controllers, including chains that can bypass security mechanisms and achieve root-level remote code execution. A compromised controller could remotely manipulate refrigeration equipment, including cooling fans and compressors, and conceal temperature increases while allowing food to spoil.

Multiple vulnerabilities were also disclosed in Danfoss AK-SM 800A refrigeration controllers, including a hidden 'code-of-the-day' authentication mechanism that could bypass authentication, a command-injection vulnerability leading to remote code execution, and an issue allowing authenticated users to inject arbitrary Nginx configuration directives, potentially causing denial of service. All identified vulnerabilities have been fixed by the vendors.

Backdoor Hides C2 in Whitespace

Gen Digital discovered a hand-written Windows backdoor that stores its C2 domain as the number of trailing spaces in a fake desktop.ini file. The 12 KB backdoor was found on a single corporate workstation during a hunt for unusual WMI persistence.

The malware is small, has a limited command set, and disguises itself as legitimate Realtek software. Its most unusual feature is its configuration: the C2 address is encoded in the number of spaces on each line of a Windows 'desktop.ini' file. To a user or automated inspection system, the file appears almost empty, but the spaces spell out the server address. There is no evidence connecting the backdoor to a known threat actor.

Why This Matters

This week's news makes one thing clear: attackers are increasingly repurposing trusted components rather than breaking them. Signed drivers, legitimate applications, and even whitespace in a file are being turned into attack primitives. That's a challenge for defenders, because signature-based blocking and behavior monitoring may miss these tricks.

The proliferation of AI-powered services like Kriminal AI, accessible on the clearnet, also lowers the barrier to entry for cybercrime. Meanwhile, the charges against the Mabna Institute show how state-sponsored actors can operate at industrial scale, with commercial-like efficiency. For businesses and individuals, the takeaway is to patch known vulnerabilities, monitor for unusual behavior, and treat trusted components with a bit more suspicion.