NT-AUTHORITY-SYSTEM-CONTEXT-RTCORE

NT-AUTHORITY-SYSTEM-CONTEXT-RTCORE 此利用程序重建并利用了CVE-2019-16098漏洞。该漏洞位于Micro-Star MSI Afterburner...

VortexCry-Ransomware-Release

VortexCry-勒索软件 VortexCry 是一款高级勒索软件，利用多阶段进程注入（例如进程挖空和 APC 注入）以及内核驱动加载（通过 CVE-2019-16098 漏洞）技术。它能够加密文件、破坏系统恢复功能并勒索赎金。 VortexCry 勒索软件仅供技术分享和学术研究目的。严禁以任何形式传播、复制或滥用此内容进行恶意活动。用户必须遵守适用法律和道德标准，确保负责任地处理这些信息。...

PT-2023-32956 · Undefined · Undefined

ParsedReport CompletenessHigh 10-07-2023 The five-day job: A BlackByte ransomware intrusion case study https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study Report completeness: High Actors/Campaigns: Volt typhoon motivation: cyber...

CVE-2019-16098

creationtimestamp| type| source ---|---|--- 2022-10-06 17:35:04+00:00| exploited| https://t.me/truesecator/3524 2024-05-21 13:04:44+00:00| seen| MISP/a9eb9e8e-d894-4f36-a6c2-ca8142f72d29 2025-08-31 03:00:54+00:00| seen| MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d 2026-02-06 21:11:55+00:00| seen|...

EDRSandblast - Tool That Weaponize A Vulnerable Signed Driver To Bypass EDR Detections And LSASS Protections

EDRSandBlast is a tool written in C that weaponize a vulnerable signed driver to bypass EDR detections Kernel callbacks and ETW TI provider and LSASS protections. Multiple userland unhooking techniques are also implemented to evade userland monitoring. As of release, combination of userland...

CVE-2019-16098

CVE-2019-16098 affects the Micro‑Star MSI Afterburner driver (RTCore64.sys/RTCore32.sys). The connected documents confirm an arbitrary read/write primitive in the vulnerable driver that allows a local authenticated user to read/write arbitrary memory, I/O ports and MSRs, enabling privilege escala...