Legacy Driver Exploitation Through Bypassing Certificate Verification

This report describes a 2024–2025 campaign that abused a vulnerable TrueSight.sys driver (legacy driver exploitation and certificate-padding manipulation related to CVE-2013-3900) to bypass Windows signature checks and Microsoft's driver blocklist, terminate security products, and deploy Gh0stRAT via phishing and messaging app distribution; Microsoft later updated its Vulnerable Driver Blocklist and vendors detected the modified driver and payloads (IOCs include MD5 hashes and OSS download URLs).