FlagThis — Daily Cybersecurity Intelligence Briefing

Attackers are exploiting a vulnerability in a Microsoft-signed kernel driver, example_driver.sys, which facilitates arbitrary kernel memory read/write operations through IOCTL 0x80002000. By leveraging this trusted signature, threat actors bypass endpoint protection by unhooking security callbacks and subverting PatchGuard. This "Bring Your Own Vulnerable Driver" (BYOVD) technique enables unauthorized privilege escalation and the theft of sensitive credentials from LSASS, SAM, and domain controllers via DCsync. This method presents a critical risk by subverting the root of trust in the Windows kernel to evade detection and facilitate widespread lateral movement across high-value environments.

In September 2026, Russian GRU Unit 26165 executed a hybrid campaign exploiting CVE‑2026‑XXXX (buffer overflow in Vendor‑A router firmware) and CVE‑2026‑YYYY (default credentials in Vendor‑B industrial gateways), combined with a signed malicious firmware update and living‑off‑the‑land binaries (PowerShell, WMIC, schtasks) to compromise ~180 critical‑facility routers across 12 EU states. The intrusion caused intermittent SCADA loss in 23 energy substations, signaling disruptions on four rail corridors, degraded VoIP for ~12k Baltic business lines, and an estimated €1.4 bn economic impact, with high‑confidence attribution to GRU Unit 26165.