Executive Summary
In May 2026, a campaign attributed to PoisonX was identified using 'WindowsTelemetry' archives to deploy a sophisticated Remote Access Trojan (RAT). The attack initiates via DLL search-order hijacking using a legitimate Microsoft binary (dashost.exe) to load a malicious VERSION.dll. This loader triggers a specialized scheduler that performs environmental preparation, including the disabling of Windows Defender and the deployment of a vulnerable driver to bypass security products.
The campaign is notable for its use of Bring Your Own Vulnerable Driver (BYOVD) techniques to silence kernel-level security callbacks. Once security controls are neutralized, the final RAT payload is executed, providing attackers with comprehensive control over the infected host, including shell access, screen capture, and SOCKS5 tunneling. The infrastructure associated with this campaign has been traced to Tencent/Aceville IP space in Hong Kong, highlighting a persistent and technically proficient threat.
This threat poses a significant risk to organizational integrity as it specifically targets the removal of EDR and antivirus kernel callbacks, rendering traditional endpoint security blind to subsequent malicious activities.