Delphos Labs

New threat intel. The LastPass TIME team and Delphos identified and disrupted a multi-stage malware delivery campaign impersonating at least 40 companies on GitHub. The payload delivered a Microsoft-attested kernel driver that terminated 145 antivirus and EDR processes from kernel mode. It scored 0 out of 72 on VirusTotal as of August 20, unchanged since July 2025. Thanks to Mike Kosak and Stephanie (Keinz) Schneider on the LastPass TIME team for working this one with us. The driver is a renamed copy of CcProtect.sys, which LOLDrivers already catalogues as a BYOVD process killer, with public proof-of-concept code. Same product string, version, and submitter. The operators changed the filename to Alinubx.sys. That was the evasion. Detections keyed to the known name did not match, and renaming a file changes its bytes, so the SHA256 moved with it. A blocklist of known bad hashes does not have this one. From there it opens each target process with KernelMode access, which skips the user-mode access check and defeats Protected Process Light without touching EPROCESS bits. There is no exploit here. The process-kill interface is product functionality, exposed by a host-defense driver that Windows trusts. Same driver, same version, same submitter, one new filename. That was enough. Joint writeup with the LastPass TIME team, on the Delphos Labs blog. Hashes, hunt queries, the full CcProtect comparison, and the MSRC timeline are in the post. https://lnkd.in/ePTJDXPA

One of our security researchers at Delphos Labs, Kamil Leoniak, triggered kernel memory corruption on Windows using a custom USB device and a user-mode stress PoC. Microsoft assigned CVE-2026-50321, classified it as a Windows USB Driver elevation of privilege rated Important, and shipped the fix on July 14. The path was surfaced during an automated Delphos review of Windows kernel drivers, then confirmed by hand. The bug is that the freed object reference stayed reachable long enough for another path to use it. WinUSB_FreePipe frees a pipe context and only nulls the shared pointer afterward. In that window the interface pipe array still contains a pointer to freed memory, and device-control IOCTLs dispatch on a WDF parallel queue under WdfSynchronizationScopeNone, so nothing serializes access to that array. 16 threads were enough. 12 calling pipe policy APIs, 4 toggling alternate settings. A policy call read the stale pointer and took a spinlock at offset 0x28 inside a freed 0xF0-byte NonPagedPool object. Without Special Pool that allocation stays mapped and reclaimable. With it, the page is unmapped and the machine bugchecks. Full writeup on the Delphos Labs blog, with the PoC on GitHub. https://lnkd.in/espxg87M

Delphos Labs has been selected by AFWERX for an SBIR Phase I focused on AI-automated analysis of source-denied software artifacts. Air Force missions run on software drawn from a vast and complex supply chain, and much of it is closed source. That software has historically had to be taken largely on trust. When someone needs a real answer about one of those files, the work falls to a small number of reverse engineers. In this Phase I we're evaluating how to put that capability in the hands of many more Air Force analysts, across a far greater volume of software. Grateful to AFWERX and the Air Force Research Laboratory for the opportunity, and proud of the team that got us here. Delphos makes software understandable and auditable even without source code, allowing analysts to vet third-party software, investigate malware, and find vulnerabilities. We do that across compiled binaries, installers, software packages, Android applications, Chrome extensions, compressed archives, firmware, and other software artifacts. https://lnkd.in/g5h9RB6r

New threat intel. 60+ AV engines called this file clean. The Delphos Labs platform called it ValleyRAT in five minutes, a full day before the first signature landed. A freshly uploaded Windows executable. The filename was the first tell: a Chinese-language lure translating roughly to "click here to visit the official Crab website," impersonating a real gaming platform. From the binary alone without sandbox detonation, prior signature, or threat intel feed, we identified it as a Chinese RAT stager. Static analysis and emulation surfaced networking imports, process creation, crypto primitives, and anti-analysis checks including debugger and VM detection. The behavioral chain confirmed it. The stager retrieves a ZIP archive from an AWS S3 bucket, extracts it, and drops a randomized-name second-stage executable, FQDSZYB.exe. String extraction returned the network indicators: the S3 payload URL, and briansclub[.]mx, a domain tied to carding forums, the C2 and update server. The vendors caught up 24 hours later, long enough for the stager to run. Writeup on the Delphos Labs blog. https://lnkd.in/e2BBPKmJ

Jonathan Looi's zero-based SOC is worth reading in full. He asks if Tier 1 gets automated, where does next generation cyber talent come from? Junior analysts get closer to real decisions, sooner. Malware analysis has long been gated behind expert reverse engineers with years of experience, which is why most teams escalate to the few who can. When our agent does the behavioral analysis and explains what a file actually does, with no source code, a junior analyst is looking at real evidence and forming a judgment early instead of waiting years for the chance. That extends the team you have rather than the headcount you hire. The call still belongs to a person. It just arrives faster, and across far more files.

On the side lines of the AI Cyber Alliance meet-up yesterday in Tyson’s Corner, some of our nation’s top defenders discussed this attack. For example we had technical leadership from the TAC there - amongst our nation’s leaders at this very subject. Thankful to Aaron Boteler from CloudCurrent who works w DeepTempo at the TAC for attending and sharing his expertise and sparking at least a few deeper conversations. Of course Joseph Szczerba who helped the nation respond to Colonial Pipeline while a leader at the FBI was one of our speakers. Thank you Joe for your heartfelt, funny and inspirational talk and for adding your expertise to many of the side conversations that sparked. The event was Chatham House so who said what is 🤐 FWIW - I know the tech I demo’d and that Joe and team build at Delphos Labs and that of others like CloudCurrent can help. We are proving it every day. I’m most excited about the community itself forming. Instead of paying CISOs to play golf w us at Vegas we are open sourcing our tech and demonstrating it in no BS meet ups. 😇 That said - the more you learn about our vulnerabilities and the pace at which our admittedly overwhelmed local decision makers are moving the more you loose sleep at night and find yourself wanting to SCREAM - look here, we can help, ask the TAC they’ll show you it all working in amazing ranges. Talk to the TAC they are 1000% in the fight to help. Talk to your local telco there is a chance they know first hand too and others. This is that scream. And also a thank you to our speakers and diverse set of attendees ranging from students to very senior protectors of our nation. There were more than a few investors and fellow builders in the room too. A special shout out to JTEK Data Solutions who is in the fight as well with systems and expertise and provided again their excellent facilities. Together we win - but we’ve got to move much much faster. Links to the AI Cyber Alliance below. Please consider sharing a talk - Boston, NYC, DC, SF and other locations all soon to be announced, w/ your help. 🤞🤝💪🏽

Two days out. Thursday in Tysons is Chatham House rules. No recordings, no transcripts. Our CISO Joseph Szczerba, formerly Senior Executive in the FBI's Cyber Division, is on stage with Evan Powell of DeepTempo. Registration is still open. https://lnkd.in/e9r45Uu8

Hugging Face incident post-mortem is out, from the Cloud Security Alliance, CISO Community with SANS, [un]prompted, RSAC, Knostic, & FIRST. Edited by Gadi Evron & David B. Cross, with Delphos Labs CISO Joseph Szczerba among the contributing authors.

On July 30th, we'll be at the AI Cyber Alliance Meetup in Tysons, Virginia. Our CISO, Joseph Szczerba, will share insights from the front lines of national cybersecurity. He'll speak alongside Evan Powell, Founder & CEO, DeepTempo. Before joining Delphos Labs, Joe was a Senior Executive in the FBI's Cyber Division, where he: → Defended against advanced nation-state cyber attacks → Led analysis of sophisticated threats to critical infrastructure → Played a key leadership role in the FBI's CISO Academy If you're working where AI meets cybersecurity, come say hello. Register on Luma: https://lnkd.in/gwPMrTAb

New threat intel. A credential stealer took the name of libpsl-5.dll, a Windows library of approximately 200KB, and inflated itself to 55MB. Zero detections across 60+ AV engines when we analyzed it. The Delphos Labs platform pulled it apart on day one; the automated run took 8 minutes, with no human intervention. The vendors did not catch up for six days. The bloated size is the primary evasion mechanism. The real code ends at about 3.3MB. The other 52MB is a single four-byte pattern repeated across the entire overlay, sitting outside every PE section and outside the image the Windows loader maps. The loader never reads it. It executes nothing. Its only job is to push the file past the size most engines and sandboxes scan. No signatures. Detection came from structural and behavioral anomalies: the size mismatch, plus an import table pairing process injection with network enumeration. Nothing a suffix-list library would do. Its code overlaps several known info-stealer families. Writeup on the Delphos Labs blog. https://lnkd.in/eBTwSHBT