Byovd on CuraSec

Spark RAT Campaign Abuses Vulnerable OPSWAT Driver via BYOVD in Cambodia

Thu, 27 Aug 2026 21:01:55 +0000

Engineer — Learn: The BYOVD technique exploiting a vulnerable OPSWAT driver to kill security tools is a notable evasion class worth understanding, but current targeting is regionally focused on Cambodia with no enrichment signals (no KEV, no PoC, no high EPSS) to justify immediate action in most environments.
SOC/IR — Plan: Build or tune detections for vulnerable OPSWAT driver loads and anomalous security-tool process terminations consistent with BYOVD; Spark RAT is open-source and signatures should be available to add to EDR and SIEM rule sets this quarter.
Leader — Skip

Fri, 21 Aug 2026 11:38:25 +0000

Engineer — Learn: Gogs 10.0 RCE and n8n workflow-to-RCE are worth tracking if you run either tool, but no enrichment signals (no KEV, PoC, or EPSS) are present and the summary is too thin to drive patching prioritization; read the underlying advisories directly for specifics.
SOC/IR — Learn: The roundup references signed-driver abuse against defenses (BYOVD pattern) and legitimate-app blending techniques, but supplies no IOCs, ATT&CK mappings, or detection guidance — useful for threat-landscape awareness only.
Leader — Skip

Mon, 27 Jul 2026 13:44:31 +0000

Engineer — Learn: BYOVD and Process Ghosting are sophisticated defense-evasion techniques that challenge standard EDR assumptions; no patch action available, but useful for evaluating EDR coverage and hardening kernel driver allow-listing policies.
SOC/IR — Plan: Multiple unrelated threat clusters adopting Cruciferra makes this detection-relevant — build or tune detections for known vulnerable driver loads (BYOVD) and process ghosting behaviors in your EDR; no IOCs surfaced yet so immediate hunting isn’t actionable.
Leader — Skip