Tag: edrsandblast

1 Attack Reports | 0 Vulnerabilities

Attack reports

How ToddyCat tried to hide behind AV software

The ToddyCat APT group has developed a sophisticated tool called TCESB to stealthily execute payloads and evade detection. This tool exploits a vulnerability (CVE-2024-11859) in ESET Command line scanner for DLL proxying, using a modified version of the open-source EDRSandBlast malware. TCESB emplo…
byovd
2025-04-07
CVE-2024-11859
kernel manipulation
dll proxying
CVE-2021-36276
tcesb
eset
edrsandblast
Published: April 7, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports