# Mabna Institute Espionage, BTR.sys Kernel Bypass, & Malware

> Runtime Rebel details state-sponsored espionage by Mabna Institute, a kernel-level bypass using Microsoft Defender's BTR.sys, and new malware campaigns.

- Published: 2026-08-24T00:41:04.000Z
- Severity: high
- Category: Threat Intel
- Tags: Grandoreiro, Mabna Institute, IRGC, BTR Sys, Kernel Bypass
- Author: Runtime Rebel Intel
- Primary source: https://thehackernews.com/2026/08/threatsday-gogs-100-rce-n8n-workflow-to.html
- Canonical: https://runtimerebel.com/blog/mabna-institute-espionage-btr-sys-kernel-bypass-malware

## Key points

- Threat actors repurpose legitimate tools and drivers to bypass security, conducting espionage and distributing malware globally.
- Affected systems include Microsoft Defender's BTR.sys, vulnerable drivers, legitimate applications, and university/government networks.
- Prioritize patching, implement robust EDR, and enhance network segmentation to counter sophisticated bypass techniques.

The cybersecurity landscape continues to be shaped by the insidious abuse of trusted components, sophisticated state-sponsored operations, and evolving [malware](/glossary#malware) tactics, as highlighted in the latest intelligence from [The Hacker News](https://thehackernews.com/2026/08/threatsday-gogs-100-rce-n8n-workflow-to.html). This week's threats emphasize how attackers leverage legitimate tools and drivers, blur the lines between cybercrime and state espionage, and employ advanced techniques to evade detection and achieve their objectives.

## Abusing Trusted Components: BTR.sys Kernel Bypass

New research from Check Point has unveiled a concerning method for bypassing [endpoint](/glossary#endpoint) security solutions by repurposing Microsoft Defender's Defender Boot-Time Removal driver (`BTR.sys`). This legitimate, Microsoft-signed driver, typically used for remediation, can be weaponized as a universal kernel operation engine. Security researcher Jiří Vinopal demonstrated the possibility of exploiting a "golden window" between system startup and user mode initialization.

The significance of this finding lies in its ability to circumvent typical `bring your own vulnerable driver` (BYOVD) defenses. Because `BTR.sys` is a signed Microsoft component, signature-based blocking is ineffective. Furthermore, a well-crafted weaponization tool, such as `BTR_CLI` as observed by Check Point, can mimic the legitimate operational footprint of Windows Defender's remediation process, making **Microsoft Defender BTR.sys [exploit](/glossary#exploit) research** a critical area for defenders to monitor. This technique allows attackers to execute kernel operations without relying on known vulnerable third-party drivers, posing a significant challenge to existing endpoint detection and response ([EDR](/glossary#edr)) mechanisms.

## State-Sponsored Espionage: The Mabna Institute

The U.S. Department of Justice (DoJ) has charged 17 members of the Mabna Institute, an Iran-based company accused of conducting a coordinated campaign of cyber intrusions since at least 2013. Operating on behalf of Iran's Islamic Revolutionary Guard Corps ([IRGC](https://en.wikipedia.org/wiki/Islamic_Revolutionary_Guard_Corps)), the institute targeted 144 U.S.-based universities, 178 foreign universities, dozens of private sector companies, and U.S. federal and state government agencies. The campaign resulted in the theft of over 31 TB of academic data and intellectual property, along with email accounts from various organizations, compromising approximately 8,000 out of 100,000 targeted professor accounts globally.

This case highlights the growing trend of privatized state espionage, where contractor groups conduct state-level work on an industrial scale. As Shmuel Gihon of Check Point noted, the Mabna Institute effectively acted as a commercial entity selling stolen research, with the IRGC as a primary client. Universities, with their high IP value, thin identity controls, and open-access culture, proved to be ideal targets for [phishing](/glossary#phishing) exploits. Understanding **Mabna Institute cyber espionage tactics** is crucial for organizations, especially in academia and government, to bolster their defenses against such persistent and resourceful threat actors. The U.S. Department of State has offered a $10 million reward for information related to five of the defendants, underscoring the severity and ongoing relevance of this threat.

## Evolving Malware Tactics: Grandoreiro and Cruciferra

### Grandoreiro Leverages Legitimate Applications

New campaigns involving the Grandoreiro banking trojan demonstrate its evolution by abusing the legitimate Duplicate Files Finder (DFF) application to execute malicious code via DLL sideloading. Telemetry from Acronis indicates Grandoreiro activity remains heavily concentrated in Latin America, with Mexico, Spain, Peru, and Argentina experiencing the majority of infections. The malware incorporates extensive anti-analysis functionality, including [sandbox](/glossary#sandbox) detection, virtual machine checks, and process blacklisting, to evade automated analysis systems. This proactive evasion, performed before contacting command-and-control ([C2](/glossary#c2)) infrastructure, underscores the operators' prioritization of stealth. For defenders, understanding **Grandoreiro malware DLL sideloading detection** is vital to protect against this financially motivated threat.

### ErrTraffic and Cruciferra's BYOVD Attacks

ErrTraffic, a malware-as-a-service (MaaS) framework and [traffic distribution system (TDS)](/glossary#traffic-distribution-system-tds) sold by the [threat actor](/glossary#threat-actor) LenAI, continues to be a conduit for multiple threats. Recent ClickFix campaigns generated by ErrTraffic have been observed delivering Cruciferra. This [payload](/glossary#payload), in turn, employs a legitimate but vulnerable driver (`DCRCVDrv.sys`) as part of a BYOVD attack to escalate privileges and terminate security processes. ErrTraffic typically infects victims via compromised WordPress sites injected with obfuscated JavaScript loaders, resolving its C2 domain by querying a Polygon smart contract. This sophisticated chain of attack aims to deliver payloads like Remus Stealer via process hollowing, demonstrating layered evasion and execution techniques.

## Actionable Recommendations

To effectively counter these sophisticated threats, security professionals should prioritize the following:

*   **Strengthen Endpoint Security:** Implement advanced EDR solutions capable of detecting kernel-level activities, even those involving legitimate drivers. Focus on behavioral analysis rather than solely signature-based detection.
*   **[Patch](/glossary#patch) Management:** Ensure timely patching of all systems and applications, paying particular attention to known vulnerable drivers and software, even if they are legitimate components.
*   **Supply Chain Vigilance:** Scrutinize software supply chains for integrity, especially when integrating third-party applications that could be leveraged for DLL sideloading or other evasive techniques.
*   **[Network Segmentation](/glossary#network-segmentation) and [Access Control](/glossary#access-control):** Segment networks to limit [lateral movement](/glossary#lateral-movement) and enforce strict access controls (e.g., [Zero Trust](/glossary#zero-trust) principles) to reduce the [blast radius](/glossary#blast-radius) of any compromise.
*   **User Education and Phishing Awareness:** Provide ongoing training to employees on recognizing sophisticated phishing and [social engineering](/glossary#social-engineering) tactics, which often serve as the initial vector for many of these campaigns.
*   **[Threat Intelligence](/glossary#threat-intelligence) Integration:** Continuously integrate and act upon the latest threat intelligence regarding nation-state actors, malware campaigns, and novel bypass techniques to proactively adapt defenses.

**Related:** [Brazilian Banking Trojan Expansion into Portugal Targets Businesses](/blog/brazilian-banking-trojan-expansion-into-portugal-targets-businesses), [Grandoreiro and BTMOB RAT Campaigns Target Windows and Android Users](/blog/grandoreiro-and-btmob-rat-campaigns-target-windows-and-android-users)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/mabna-institute-espionage-btr-sys-kernel-bypass-malware