Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

An issue in the HwRwDrv.sys component of Nil Hardware Editor Hardware Read & Write Utility v1.25.11.26 and earlier allows attackers to execute arbitrary read and write operations via a crafted request.

CVE-2025-66678 is a critical security vulnerability found in the HwRwDrv.sys kernel-mode driver component of the Nil Hardware Editor Hardware Read & Write Utility, specifically versions 1.25.11.26 and earlier. This vulnerability allows attackers to execute arbitrary read and write operations on system memory by sending crafted requests to the driver. The flaw stems from improper input validation or insufficient access control in the driver interface, enabling direct memory manipulation without requiring authentication or user interaction. The vulnerability is classified under CWE-89, which typically relates to improper neutralization of special elements used in an OS command (commonly SQL injection), but here it likely refers to improper handling of input leading to unauthorized memory access. The CVSS v3.1 base score is 9.8, reflecting the vulnerability's network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), and high impact on confidentiality (C:H), integrity (I:H), and availability (A:H). Exploitation could allow attackers to read sensitive data, modify critical system components, or cause system crashes, potentially leading to full system compromise. Despite no known exploits in the wild at the time of publication, the vulnerability's characteristics make it a prime target for attackers. The lack of available patches necessitates immediate risk mitigation and monitoring for any emerging exploit attempts.

Detailed information about CVE-2025-66678: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2025-66678: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-66678: n/a

Akira affiliates have been observed exploiting two common drivers as part of a suspected AV/EDR evasion effort following initial access involving SonicWall abuse. The drivers, rwdrv.sys and hlpdrv.sys, are being used to facilitate AV/EDR evasion or disablement through a Bring Your Own Vulnerable Driver (BYOVD) exploitation chain. This behavior has been prevalent in recent Akira ransomware incident response cases. The campaign may be driven by an unreported zero-day vulnerability in SonicWall VPNs. Defenders are advised to harden SonicWall VPNs, implement recommended mitigations, and use provided YARA rules for detection and response to pre-ransomware activity.

The observed threat involves the Akira ransomware affiliates exploiting vulnerabilities related to SonicWall VPN appliances to gain initial access into targeted networks. Following this initial compromise, the attackers employ a Bring Your Own Vulnerable Driver (BYOVD) technique by leveraging two common Windows drivers, rwdrv.sys and hlpdrv.sys. These drivers are legitimate but vulnerable, and their exploitation allows the attackers to evade or disable antivirus (AV) and endpoint detection and response (EDR) solutions. This evasion is critical for the attackers to maintain persistence and avoid detection during the pre-ransomware activity phase. The campaign is suspected to be driven by an unreported zero-day vulnerability in SonicWall VPNs, which are widely used for secure remote access. The use of BYOVD is a sophisticated tactic that involves loading vulnerable drivers to execute malicious code with kernel-level privileges, effectively bypassing security controls. The campaign has been linked to multiple recent Akira ransomware incident response cases, indicating an ongoing and active threat. Defenders are advised to harden SonicWall VPN configurations, apply any recommended mitigations, and utilize YARA detection rules provided by threat intelligence sources to identify and respond to this activity before ransomware deployment. The attack techniques correspond to MITRE ATT&CK tactics such as initial access (T1078), privilege escalation (T1068), persistence (T1547.006), defense evasion (T1562.001), and user execution (T1204.002). No public CVE or patch is currently available, and no known exploits in the wild have been confirmed, but the threat is active and evolving.

MD5 of 16f83f056177c4ec24c7e99d01ca9d9d6713bd0497eeedb777a3ffefa99c97f0

SHA1 of 16f83f056177c4ec24c7e99d01ca9d9d6713bd0497eeedb777a3ffefa99c97f0

Detailed information about Observed Malicious Driver Use Associated with Akira SonicWall Campaign. Get real-time updates, technical details, and mitigation stra


CVE-2025-66678: n/aCVE-2025-66678 0 An issue in the HwRwDrv.sys component of Nil Hardware Editor Hardware Read & Write Utility v1.25.11.26 and earlier allows attackers to execute arbitrary read and write operations via a crafted request. CriticalVulnerabilityUnited StatesGermanyJapan+7#cve #cve-2025-66678 Join the discussion	CVE Database V5	03/04/2026, 00:00:00 UTC Added: 03/04/2026, 17:18:18 UTC
Observed Malicious Driver Use Associated with Akira SonicWall Campaign 0 Akira affiliates have been observed exploiting two common drivers as part of a suspected AV/EDR evasion effort following initial access involving SonicWall abuse. The drivers, rwdrv.sys and hlpdrv.sys, are being used to facilitate AV/EDR evasion or disablement through a Bring Your Own Vulnerable Driver (BYOVD) exploitation chain. This behavior has been prevalent in recent Akira ransomware incident response cases. The campaign may be driven by an unreported zero-day vulnerability in SonicWall VPNs. Defenders are advised to harden SonicWall VPNs, implement recommended mitigations, and use provided YARA rules for detection and response to pre-ransomware activity. MediumMalwareGermanyUnited KingdomFrance+7#zero-day #akira #vpn Join the discussion	AlienVault OTX General	08/08/2025, 08:07:28 UTC Added: 08/08/2025, 08:17:47 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Search Results: "rwdrv.sys"

Lead Pen Test Professional