Category

deep-dive

15 articles

malware malware incident-response deep-dive

EDR Killers Explained: Beyond the Drivers

Background In late 2025, the ransomware group known as “BlackHawk” deployed a novel EDR‑killer that combined two tactics: (1) exploitation of CVE‑2026‑48689—a newly disclosed vulnerability in Windows kernel memory management—to inject a malicious driver into the system, and (2) use of the legitimate Microsoft “Windows

Edgerunner Edgerunner 9 min read
api-security api-security deep-dive threat-intelligence

API Attack Surface Nobody Audits — and How It’s Bleeding Data

Background In 2025, 68% of enterprises deployed new microservices without implementing rate limiting, allowing attackers to brute‑force endpoints within hours. This trend has turned APIs into the primary interface through which modern organizations expose data and functionality to internal systems, partners, and end users. What once started as a

Edgerunner Edgerunner 10 min read
vulnerability vulnerability cve threat-intelligence

RedSun and the Defender Paradox: When Your AV Becomes the Attack Vector

Microsoft Defender faces a paradox: BlueHammer and RedSun zero-days exploit privilege escalation vectors within your own security tools. Read how attackers weaponize Defender and why the 'UnDefend' dilemma requires immediate patch management action before

Edgerunner Edgerunner 7 min read
identity-security identity-security ransomware threat-intelligence

It's Not the Zero-Day: Why Stolen Passwords Are Still Killing You in 2026

The 2026 threat landscape prioritizes industrial-scale exploitation of known weaknesses over exotic zero-days. With automated bots scanning at 36k/sec and identity compromise driving 85% of alerts, defenders must shift focus from zero-day hunting to patch

Edgerunner Edgerunner 7 min read