Attackers can downgrade Windows kernel components to bypass security features such as Driver Signature Enforcement and deploy rootkits on fully patched systems. This is possible by taking control of ...

Microsoft security researchers are warning about a new generation of powerful system monitoring programs, or “rootkits,” that are almost impossible to detect using current security products and that ...

North Korean threat actors known as the Lazarus Group exploited a flaw in the Windows AppLocker driver (appid.sys) as a zero-day to gain kernel-level access and turn off security tools, allowing them ...

You cannot rely on kernel access to fight kernel rootkits. You'll have to rely on a higher level entity that can vouch for the security of the levels below. So even CrowdStrike wouldn't be able to ...

A new version of the malware that crippled Windows PCs last February sidesteps safeguards designed to block rootkits from hijacking machines running 64-bit editions of Windows, researchers said ...

A distributed system of monitoring groups of computers using the same operating-system configuration can detect the changes wrought by rootkits following infection, a group of security researchers ...

Researchers warn that a Windows kernel privilege escalation in vulnerability fixed by Microsoft during the February Patch Tuesday was exploited in the wild as a zero-day by a North Korean threat actor ...

The good news is that neither rootkit has shown up in the wild. And Dai Zovi says such a hack is not imminent. The bad news: Dai Zovi says these hacks haven’t been unleashed on unsuspecting enterprise ...

On July 26, McAfee will begin offering a new application called Rootkit Detective, designed to detect and remove dangerous rootkit attacks. The software will also help end users ward off the threats, ...

One of the newest threats in the wild—what security mavens mean by "loose on the net"—is called a "rootkit," or RK for short. While a rootkit by itself causes no damage, it attempts to ...

A Windows zero-day vulnerability recently patched by Microsoft was exploited by hackers working on behalf of the North Korean government so they could install custom malware that’s exceptionally ...