SecurityWeek

Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit

The China-linked Mustang Panda APT has been using a kernel-mode rootkit in attacks leading to ToneShell backdoor deployments.

Chinese state hackers use rootkit to hide ToneShell malware activity

A new sample of the ToneShell backdoor, typically seen in Chinese cyberespionage campaigns, has been delivered through a kernel-mode loader in attacks against government organizations.
PC Magazine

kernel mode

The operating system mode. Processors operate either in kernel mode or "user mode." Also called "supervisor mode," the kernel mode enables the OS (kernel) to execute "privileged instructions," which ...
GIGAZINE

CrowdStrike問題を受けセキュリティベンダーがWindowsカーネル外で活動 ...

2024年7月に発生したCrouwdStrikeによるWindows PCの大規模障害を受けて、Microsoftは2024年9月10日にセキュリティサミットを開催しました。サミットの中でMicrosoftは「アンチウイルス監視用の特別なプラットフォームを作成し、セキュリティ製品をカーネルから ...