BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//pretalx.com//hack-lu-2025//talk//QSWNWS
BEGIN:VTIMEZONE
TZID:Europe/Luxembourg
BEGIN:DAYLIGHT
DTSTART:20241022T000000
TZNAME:CEST
TZOFFSETFROM:+0200
TZOFFSETTO:+0200
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:20241027T030000
RDATE:20251026T030000
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20250330T030000
RDATE:20260329T030000
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
SUMMARY:Silent Killers: Unmasking a Large-Scale Legacy Driver Exploitation
  Campaign - Jiří Vinopal
DTSTART;TZID=Europe/Luxembourg:20251022T111500
DTEND;TZID=Europe/Luxembourg:20251022T114500
DTSTAMP:20261015T205332Z
UID:pretalx-hack-lu-2025-QSWNWS@pretalx.com
DESCRIPTION:What if your trusted security solutions could be silently disa
 rmed without warning? What if a long-forgotten vulnerability in a legitima
 te driver became the perfect weapon for attackers to bypass defenses and s
 trike undetected?\n\nIn 2025\, Check Point Research uncovered a sophistica
 ted campaign leveraging over 2\,500 unique variants of a vulnerable legacy
  driver to disable EDR and AV solutions. By abusing a loophole in Windows 
 driver signing\, the attackers successfully deployed a powerful EDR/AV kil
 ler module that bypassed Microsoft’s Vulnerable Driver Blocklist and eva
 ded detection mechanisms\, including those introduced by the LOLDrivers pr
 oject.\n\nTo ensure stealth\, the attackers carefully manipulated the driv
 er’s PE structure\, generating distinct hashes while preserving its vali
 d signature — a move that allowed thousands of modified variants to rema
 in undetected. Operating from a public cloud’s China region\, the attack
 ers targeted victims primarily in China and parts of Asia\, with devastati
 ng precision.\n\nCheck Point Research’s findings prompted Microsoft to u
 pdate its Vulnerable Driver Blocklist\, neutralizing the exploited driver 
 variants. This paper presents the campaign’s technical details\, explore
 s the evasion techniques in depth\, and provides practical insights for de
 fenders to mitigate emerging driver exploitation threats. Are your defense
 s prepared for attackers turning trusted code into a silent threat?
LOCATION:Europe
URL:https://pretalx.com/hack-lu-2025/talk/QSWNWS/
END:VEVENT
END:VCALENDAR