VMware VMCI: Stealthy Communication Channel
VMware VMCI is a virtual communication interface that allows traffic to pass through the virtualization layer, bypassing network adapters. SLEEPWALKER uses VMCI…
Tag: stealth
COOLCLIENT: Updated Backdoor with Kernel-Mode Driver
COOLCLIENT is a backdoor used by Mustang Panda. An updated variant deploys a signed kernel-mode driver (Msagent.sys) to hide processes and protect…
msagent.sys Rootkit Driver
msagent.sys is a signed Windows kernel-mode driver used by the latest CoolClient variant. It provides stealth by hiding processes, files, registry keys,…
Picus Red Report 2026: Adversary Trends and Stealth Tactics
The Picus Red Report 2026 examines adversary behavior, noting a deliberate shift toward stealth. Attackers are increasingly using low-noise techniques such as…
AWS, Google, and Vercel Patch Agent Flaws Allowing Tool Execution Without Model Authorization
Security researchers have uncovered a class of vulnerabilities in agent infrastructure from Amazon Web Services (AWS), Google, and Vercel that allow attackers…
Stealth Researchers Discover CoreBreak
Co-founders Hedi Ingber and Aviyam Ivgi of Stealth presented the CoreBreak pattern at Black Hat USA 2026, revealing vulnerabilities in AWS, Google,…
TONESHELL: Kernel-Mode Enhanced Backdoor
TONESHELL is a backdoor associated with China-nexus threat actors, notable for its kernel-mode driver enhancements that improve stealth and persistence. It has…