Loading story…
Researchers demonstrated that the Microsoft-signed Windows Error Reporting Dump Encoding Library, WerEnc.dll, can be modified in memory to encrypt attacker data using an attacker-controlled RSA public key. The bring-your-own-key (BYOK) technique replaces the DLL's embedded Microsoft RSA-4096 public-key blob after changing memory protections, then calls EncryptDumpFile or EncryptDumpStream to create AES-256-CBC-encrypted containers. The AES session key and IV are RSA-wrapped to the substituted public key, allowing only the attacker-held private key to decrypt the output.
Public proof-of-concept tooling reportedly supports key generation, local encryption and decryption, payload execution, and optional HTTP retrieval of BYOK keys or encrypted implants from command-and-control infrastructure. This living-off-the-land method can reduce malware cryptographic code and make protected payloads resemble Windows Error Reporting artifacts. Defenders should investigate unexpected WerEnc.dll loads by non-error-reporting processes, memory-protection changes affecting the library, suspicious creation of encrypted dump-like files, and related outbound network activity.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
On September 15, 2026, 0xsp published research describing replacement of WerEnc.dll's embedded RSA public key in memory so its dump-encryption functions encrypt data for an attacker-controlled key. The disclosure included public proof-of-concept tooling for key generation, DLL patching, encryption/decryption, execution, and optional HTTP-based retrieval of encrypted payloads.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
5 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourceipurple.team
Open sourcecyberveille.ch
Open source0xsp.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Huntress reported an intrusion in which attackers deployed a custom **EDR killer** that disables endpoint security by abusing a legitimate but long-revoked kernel driver originally shipped with Guidance Software’s *EnCase* forensics product. The malware embeds the vulnerable driver (reported as `EnPortv.sys`) and uses a **Bring Your Own Vulnerable Driver (BYOVD)** approach: once the driver is loaded, it exposes an `IOCTL` interface that enables user-mode code to terminate arbitrary processes from kernel mode, bypassing user-mode protections including **Protected Process Light (PPL)**. The tool is described as capable of targeting **59** endpoint security products. In the observed incident, initial access was achieved by successfully authenticating to **SonicWall SSL VPN** using previously compromised credentials, with reporting noting the absence of **MFA** on the VPN account. Post-compromise activity included internal reconnaissance (e.g., ICMP ping sweeps, NetBIOS/SMB probing) and high-rate SYN activity, followed by execution of the EDR killer disguised as a legitimate utility (e.g., a firmware update tool). The malware reportedly uses a custom encoding scheme to conceal the embedded driver, writes it to disk under an OEM-like path, hides it, timestomps it to blend in, and registers it as a Windows kernel service for persistence; despite the driver’s certificate being expired and revoked for years, Windows can still load it due to signature verification and timestamping behavior.
Jul 4, 2026
Researchers reported a malware campaign that abuses the legitimate Windows Error Reporting binary **`WerFault.exe`** to stealthily deploy **Pupy RAT** through DLL sideloading. The infection chain begins with a phishing email carrying an ISO attachment that contains `WerFault.exe`, a malicious **`faultrep.dll`**, a decoy **XLS** file, and a shortcut file that launches the payload via **`scriptrunner.exe`** and `cmd`. Because `WerFault.exe` is a Microsoft-signed binary, the technique helps the malware blend in with normal system activity and reduce suspicion from security tools. Analysis showed the malicious DLL uses a custom API resolver, spawns threads to open the lure spreadsheet, decrypts an embedded overlay with **RC4** using **`SystemFunction032`**, and loads the decrypted PE directly into memory as **Pupy RAT**. The RAT was observed attempting to reach a command-and-control server at **`103.79.76.40`**, although the server was offline during examination. Researchers said attribution remains unconfirmed, but the Chinese-language lure and other indicators suggest the operators may be China-based or targeting victims in China; the use of Pupy RAT also raises concern because the open-source remote access trojan has previously been linked to espionage activity and enables full device compromise.
Aug 15, 2026
Researchers identified **SLEEPWALKER**, an unsigned 64-bit Windows DLL backdoor that masquerades as `dpapi.dll` and is designed to be side-loaded by the ESET Management Agent process, `ERAAgent.exe`. Unlike conventional implants, it does not beacon to fixed command-and-control infrastructure; it remains dormant until it receives a specially crafted, encrypted network packet, then decrypts and executes attacker tasking. The malware uses a proprietary 23-instruction bytecode interpreter supporting task scheduling, staged payload delivery, lateral movement, multiple communications channels, and direct in-memory shellcode execution. The analyzed sample enables a raw-packet listener and places interfaces in promiscuous mode; code also suggests potential triggering or communications over DNS, TCP, UDP, ICMP, SMB named pipes, and VMware VMCI. No threat actor, victim, delivery vector, campaign, or confirmed real-world use has been identified. Defenders should investigate untrusted DLLs loaded by management agents, promiscuous packet capture, unusual named-pipe or SMB configuration changes, suspicious pipes, and anomalous in-memory activity.
Sep 1, 2026