Loading story…
Cymulate researchers disclosed Blindside, a Windows defense-evasion technique that uses hardware breakpoints and debug registers to acquire a clean ntdll.dll image and replace the hooked .text section in a target process. It creates a child process under debugging, breaks on LdrLoadDll to prevent further DLL loading, and copies the child’s clean ntdll memory before user-mode EDR instrumentation can be introduced. Cymulate said the technique bypassed many, but not all, tested EDR and XDR products and that it notified affected vendors.
The research builds on DLL-unhooking approaches that recover ntdll from newly created suspended processes, where the library is mapped before EDR user-mode DLLs may load. Such techniques can locate the module through the PEB, read its clean image from the child process, change target-memory protections, and restore the original .text bytes to remove syscall hooks; Cymulate reported a proof of concept subsequently loaded encrypted calculator shellcode against some products. Defenders should detect anomalous debugging activity, especially SetThreadContext calls and changes to debug registers DR0–DR3, correlated with suspended-child creation, LdrLoadDll breakpoints, cross-process memory reads, and writes to ntdll executable code.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
A technique was described that creates a suspended child process to read its initially unhooked ntdll.dll image, then overwrites the current process’s hooked ntdll .text section. The proof of concept reportedly unhooked ntdll and loaded encrypted calculator shellcode against some tested EDR products, while others detected the behavior.
Cymulate stated that it notified vendors whose products were tested and submitted a Blindside report to the Microsoft Security Response Center before publication. Microsoft had declined to comment at the time described by the source.
Cymulate Offensive Research Group described Blindside, which debugs a child process, prevents further DLL loading at LdrLoadDll, and copies its clean ntdll.dll .text section over a target process’s hooked ntdll. Cymulate reported the technique bypassed many, but not all, tested commercial EDR and XDR products.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
cymulate.com
Open sourcecymulate.com
Open sourceired.team
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Windows malware and offensive tradecraft increasingly rely on **direct system calls**, **NTDLL unhooking**, and related userland-hook bypass methods to evade antivirus and EDR monitoring during code injection and process manipulation. Public research describes replacing high-level WinAPI calls with `Nt*` syscalls such as `NtAllocateVirtualMemory`, `NtWriteVirtualMemory`, and `NtCreateSection`, often through custom assembly stubs or frameworks like **SysWhispers**, to avoid hooks placed in `ntdll.dll`. Other documented techniques include restoring clean `.text` sections of loaded DLLs from disk, dynamically invoking APIs without standard imports, and abusing TLS-based reentrancy checks in inline hooks so security products skip behavioral inspection. These methods are reflected in real malware analyses. **WikiLoader** was observed using indirect syscalls via `ntdll.dll` to change memory protections, inject code into `bingmaps.dll`, and later inject shellcode into `explorer.exe` with `ZwOpenProcess`, `ZwAllocateVirtualMemory`, and `ZwWriteVirtualMemory`. An **XWorm** loader used direct `Nt*` syscalls for section-based payload injection into legitimate processes while checking for JMP opcodes on `Nt` functions as an anti-hooking measure. A separate **APT29-linked Dropbox loader** resolved direct syscalls through hashed lookups and restored DLL code sections from disk to remove user-mode hooks before maintaining persistence and exchanging encrypted payloads through Dropbox-based command and control.
Aug 15, 2026
Multiple public research reports detailed how attackers can evade Windows security monitoring by abusing native APIs, loader behavior, and application logging. White Knight Labs and XPN documented techniques to suppress or bypass **Event Tracing for Windows (ETW)** visibility in .NET and Windows processes, while separate research showed that access-mask-based detections can be defeated with `DuplicateHandle` by first requesting only `PROCESS_DUP_HANDLE` and then cloning a more privileged handle to targets such as **LSASS** or **winlogon**. Microsoft documentation for `CreateProcessA` also appeared in the reference set because process creation remains central to many payload chains, including shellcode that ultimately launches command shells or follow-on tooling. Additional reports showed how attackers can blend execution into legitimate Windows behavior and trusted software. iPurple described **EntryPoint Hijacking**, in which a loaded DLL's entry point is overwritten so malicious code runs during normal thread creation or loader activity, reducing obvious injection signals and complicating EDR detection. NVISO separately analyzed Metasploit reverse-shell shellcode that walks the **PEB** and resolves APIs such as `LoadLibraryA`, networking functions, and `CreateProcessA`, while Hunt & Hackett showed that **ConnectWise Control/ScreenConnect** can be used for intrusion activity and that its own event logging can be disabled by patching `ScreenConnect.Core.dll`. Together, the reports underscore that defenders must validate loader integrity, monitor low-visibility handle requests and memory writes, and avoid relying on a single telemetry source such as ETW or application-generated event logs.
Aug 15, 2026
Two separate Windows-focused research writeups describe practical **evasion techniques against Microsoft Defender/EDR**. One demonstrates bypassing Defender’s signature-based detections by constructing suspicious strings (e.g., `Invoke-Mimikatz`) at runtime using PowerShell character encoding/concatenation (`[char]NN`), reporting reliable evasion in a fully updated Windows 10/11 environment with real-time protection and script scanning enabled. A second report covers **EDRStartupHinder**, a newly released tool by researcher **TwoSevenOneT** that aims to prevent antivirus/EDR services from starting cleanly on boot (demonstrated against Defender on Windows 11 25H2). The technique uses a higher-priority Windows service and **Bindlink** redirection of a selected `System32` DLL to a tampered (“corrupted”) copy so the protected EDR process (e.g., `MsMpEng.exe`, running as **PPL**) fails to load required dependencies and crashes at startup; the article notes operator requirements such as choosing a DLL not in `KnownDLLs` and identifying service group order via `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder` and tooling like Process Monitor/Process Explorer boot logs.
Jun 29, 2026