ToddyCat APT Targets ESET Bug to Load Silent Malware

Kaspersky reported that the Chinese-speaking ToddyCat APT exploited a DLL search order hijacking vulnerability in ESET antivirus (CVE-2024-11859) to force the product to load a malicious version.dll delivering the TCESB payload, which can stealthily execute code and disable Windows kernel-level security; the actors also leveraged a vulnerable Dell driver (CVE-2021-36276) for kernel-level activity. ESET patched the issue in January and organizations are advised to monitor for installation of known-vulnerable drivers, unexpected kernel debug symbol loads, and to verify digital signatures of loaded system libraries.