A researcher releases FalconFlank, a zero-day that abuses CrowdStrike Falcon’s Office macro remediation to gain SYSTEM privileges on fully patched Windows 11 and Server machines. Disable the suspicious macro removal policy until an official fix lands.

Kaspersky has found a new CoolClient backdoor variant carrying a signed kernel driver that hides processes, files, registry keys, and network connections. The HoneyMyte group (Mustang Panda) is using it against governments in Asia — detecting it requires kernel-level telemetry.

An Akira ransomware affiliate got initial access through a SonicWall VPN with no MFA, then rebooted the box into Safe Mode to neutralize EDR while exfiltrating. Huntress’s account shows an EDR is no safety net once an attacker holds valid credentials.