Security researchers at Kaspersky have discovered that a Chinese-affiliated threat group known as ToddyCat is exploiting a vulnerability in ESET security software to deliver a sophisticated malware called TCESB. This previously undocumented malware is designed to bypass protection and monitoring tools on infected systems.

ToddyCat, which has targeted organizations across Asia since at least December 2020, has been observed using this new technique in early 2024. The attack involves a suspicious DLL file (“version.dll”) placed in the temp directory of compromised devices.

## The Attack Method

The attackers exploit a security flaw (CVE-2024-11859) in ESET Command Line Scanner through DLL Search Order Hijacking. The vulnerability stems from ESET’s insecure loading of “version.dll,” where it checks the current directory before system directories. This allows attackers to substitute Microsoft’s legitimate version.dll with their malicious version.

ESET patched this vulnerability in January 2025, noting that while the attack requires administrator privileges, it enables attackers to execute malicious code on affected systems.

## TCESB Capabilities

TCESB is a modified version of the open-source tool EDRSandBlast with enhanced features to:

– Alter kernel structures to disable security notification routines
– Employ a “bring your own vulnerable driver” (BYOVD) technique
– Install a vulnerable Dell driver (DBUtilDrv2.sys) with a known privilege escalation flaw (CVE-2021-36276)
– Check every two seconds for encrypted payload files that are then decoded and executed

## Security Recommendations

Kaspersky recommends organizations:
– Monitor systems for installation of drivers with known vulnerabilities
– Watch for Windows kernel debug symbol loading events on devices where kernel debugging isn’t expected

This incident highlights the ongoing sophistication of threat actors who continue to find new ways to circumvent security measures.