Tag

#edr

1 post tagged #edr.

Analysis · May 20, 2026 · Colten Anderson

Scattered Spider didn't need a zero-day. They brought a decade-old driver Windows still loads.

CVE-2015-2291 is a vulnerable Intel Ethernet driver. Scattered Spider loaded it to reach the kernel and patch out Defender, CrowdStrike, SentinelOne, and Palo Alto in memory. It's the classic bring-your-own-vulnerable-driver attack, and the defenses are switches you can flip today.