On July 18th, 2025, ESET researchers publicly disclosed the CVE-2025-8088 vulnerability.  Although WinRAR’s response was swift with the release of a patch (version 7.13) on July 30, 2025 the window between disclosure and patch availability was long enough for adversaries to weaponize the flaw and conduct successful intrusions.   This campaign explores in depth how CVE-2025-8088 […]

Microsoft recently faced critical vulnerabilities in on-premises SharePoint servers that have been actively exploited in the wild.   To mitigate these threats, Microsoft issued customer guidance and released security updates for CVE-2025-53770 and CVE-2025-53771, covering all supported SharePoint versions.  In this month’s campaign, we’re dissecting this multi-stage exploit chain, known as the ToolShell campaign.   Let’s dig […]

Threat actors are increasingly exploiting legitimate signed software to gain elevated privileges and bypass system defenses.  In this month’s campaign, we will explore the RTCore driver (RTCore64.sys) from MSI™ Afterburner, used for overclocking graphics cards, and how, when running in kernel mode, it can provide low-level access to hardware. Overview of the RTCore driver exploitation  […]