The Gentlemen Weaponize a Signed Kontron Driver Into an EDR Killswitch

A newly analyzed BYOVD zero-day used by The Gentlemen ransomware crew tops today’s offensive beat. Fresh DOJ court filings also reveal exactly how Microsoft telemetry led the FBI to the Scattered Spider suspect grabbed at Helsinki Airport, and researchers dropped a pile of new red-team tooling.

Vulnerabilities & Exploits

• The Gentlemen ransomware exploited a zero-day in a signed Kontron driver to disable endpoint defenses via classic BYOVD, gaining kernel-level access to terminate security processes before deploying ransomware, per Expel’s analysis. Recommended mitigations include driver blocklisting, VBS, and WDAC. The group has been active this week, adding roughly 20 new victims to its leak site including EMS provider Medic Rescue and German meat giant Tönnies (Expel).
• Bad Epoll (CVE-2026-46242) now has a public PoC — J-jaeyoung/bad-epoll — for the Linux kernel epoll use-after-free that turns an unprivileged user into root on 6.4+ kernels (and potentially newer Android), with the researcher reporting 99% reliability and a possible trigger path from Chrome’s renderer sandbox (The Hacker News).
• A second Linux LPE, CVE-2026-31694, a FUSE readdir page-cache overflow, also has public PoCs demonstrating out-of-bounds writes and privilege escalation via unprivileged FUSE mounts when a malicious server sets an oversized namelen (PoC).
• Six critical, previously unknown vulnerabilities in Apple AirDrop and Google/Samsung Quick Share expose 5+ billion devices to proximity-based, pre-authentication attacks — some potentially enabling RCE — per a new academic paper on protocol-level flaws in the wireless sharing stacks (paper, CyberInsider).
• runZero disclosed seven unpatched vulnerabilities in FatFs, the ubiquitous FAT/exFAT filesystem library bundled into firmware for security cameras, drones, industrial controllers, and hardware crypto wallets — affecting millions of embedded and IoT devices (The Hacker News).

New Tools & Releases

• T3MP3ST is a self-hosted, multi-agent offensive-security framework that turns an AI coding agent into a full red-team workflow — authorized recon, exploit testing, reporting, a web “War Room,” CLI, MCP support, and built-in scope controls (AGPL-3.0) (GitHub).
• A Havoc C2 BOF port of the KslD.sys BYOVD technique extracts credentials from lsass via physical memory — no OpenProcess, no auditable API calls (GitHub).
• Improved RpcGhosting uses a selective trampoline hook to preserve the AMSI bypass while preventing the in-process RPC failures that broke earlier implementations (write-up).
• goshs is a single-binary red-team file server supporting HTTP/S, WebDAV, FTP/SFTP, SMB, LDAP/S, NTLM hash capture, and DNS/SMTP callbacks — a heavyweight python3 -m http.server replacement (GitHub).
• tf-mythic-azure automates Mythic C2 deployment in Azure via Terraform (GitHub); a companion GeoLocation BOF pulls Windows location data via WinRT for scope/region-gated engagements (GitHub).
• Knossos (Praetorian) procedurally generates highly realistic decoy AWS environments with learned style profiles, strategic misconfigurations, and telemetry to deceive and track attackers (blog).
• Diaphora MCP wires Diaphora binary-diffing into IDA Pro for automated change analysis and callgraph work (GitHub); Flounder is an autonomous white-hat audit workflow with sandboxed discovery and execution-grounded verification (GitHub).

Threat Activity & Intelligence

• Newly unsealed DOJ filings detail how Microsoft telemetry helped the FBI identify alleged Scattered Spider member Peter Stokes, a 19-year-old US-Estonian arrested at Helsinki Airport with the help of Finland’s National Bureau of Investigation. Microsoft linked a Windows Global Device ID (GDID) to the creation of an ngrok account used in the May 2025 intrusion of a luxury jewelry retailer, then correlated it with provider, Apple, Snapchat, and Facebook records — identification came from multi-source correlation, not GDID alone (Tom’s Hardware, affidavit).
• A U.S. government agency reportedly paid ~$1M in Bitcoin to data-extortion group Kairos, per Ransom-ISAC’s reconstruction from leaked negotiation logs and blockchain tracing. Notably, no encryptor or locker binary has been tied to Kairos — this was pure data theft and deadline pressure (Ransom-ISAC).
• The nSafe ransomware group has returned with a refreshed leak site, listing two German victims including one of Europe’s largest multinational financial institutions and directing the victim to negotiate via a third-party software company (Ido Cohen). Separately, newcomer Doommageddon is ramping fast, claiming a major Turkish automotive manufacturer within 20 days of surfacing (Ido Cohen).
• Medtronic is notifying nearly 3.8 million individuals after a ShinyHunters data theft exposed personal and medical data; the company says patient safety and operations are unaffected (SecurityAffairs).
• Nordea warns that a handful of Nordic customers have been hit by card skimming at Central and Southern European tourist destinations since last autumn, with skimming devices found on public-transport ticket machines and fuel-station payment terminals (IS Digitoday).

Detection & Purple Team

• Synacktiv published part two of its deep dive on cross-domain and cross-forest RBCD, mapping resource-based constrained delegation abuse into escalation paths that cross trust boundaries — useful for both AD attack planning and defensive coverage (Synacktiv).
• A detailed guide on detecting Microsoft Sentinel tampering covers nine attacker evasion scenarios and how to catch them using AzureActivity logs, Sentinel audit/health data, and watchlists — closing a common SIEM blind spot (detect.fyi).
• “Hunting Sleeping Giants” breaks down how Gargoyle, FOLIAGE, and Ekko implement encrypted beacon sleep obfuscation and the layered detections that catch them (write-up).

AI & Model Security

• Security research on Ollama disclosed two vulnerabilities with PoCs — a crash via malformed GGUF files and resource exhaustion through an unchecked vocab size — relevant to anyone self-hosting local model inference (GitHub).
• ironcurtain is a secure runtime for autonomous AI agents where the security policy is derived from a plain-English “constitution,” aiming to constrain tool-using agents at runtime (GitHub).
• On the capability front, Anthropic’s Claude Fable 5 continues to impress practitioners: Simon Willison reported it found and fixed five release blockers in a final code review, and a DeepMind developer used Claude Code to port 2003’s Command & Conquer: Generals to native iOS in hours (Simon Willison, The Decoder).