GhostTree and GhostBranch NTFS junction loops that evade recursive folder scanning
Technical Analysis
Summary
Hide ▲
Show ▼
GhostTree and GhostBranch use recursive NTFS junction loops to generate effectively unlimited paths, allowing files in the same folder to evade EDR and Windows Defender recursive scans.
Related Happenings
Fake AI study guide AsyncRAT lure campaign targeting Windows users
Campaign
H score33
First: 11.06.2026 17:00
Last: 11.06.2026 17:00
Sources 1
About this happening:
A malware-luring campaign now uses fake AI study guides and developer resources to target Windows users at organizations, increasing the risk of stealthy AsyncRA...
Fake AI study guide AsyncRAT lure campaign targeting Windows users
CampaignAbout this happening: A malware-luring campaign now uses fake AI study guides and developer resources to target Windows users at organizations, increasing the risk of stealthy AsyncRA...
Gamaredon Ukraine espionage campaign targeting government, military and critical infrastructure
Campaign
H score56
First: 01.06.2026 14:00
Last: 01.06.2026 14:00
Sources 1
About this happening:
The Gamaredon espionage campaign remained active in January 2026, targeting Ukrainian government, military, and critical-infrastructure networks to steal documents and...
Gamaredon Ukraine espionage campaign targeting government, military and critical infrastructure
CampaignAbout this happening: The Gamaredon espionage campaign remained active in January 2026, targeting Ukrainian government, military, and critical-infrastructure networks to steal documents and...
GhostLock CreateFileW share-mode file-locking technique
Technical Analysis
H score24
First: 12.05.2026 01:02
Last: 12.05.2026 01:02
Sources 1
About this happening:
GhostLock exposes a file-locking technique that abuses Windows CreateFileW to deny access to files on local systems and SMB shares. Because the method relies on legiti...
GhostLock CreateFileW share-mode file-locking technique
Technical AnalysisAbout this happening: GhostLock exposes a file-locking technique that abuses Windows CreateFileW to deny access to files on local systems and SMB shares. Because the method relies on legiti...
APT28 Windows Shell LNK campaign targeting Ukraine and E.U. nations
Campaign
H score39
First: 28.04.2026 08:50
Last: 28.04.2026 08:50
Sources 1
About this happening:
A December 2025 APT28 campaign targeted Ukraine and E.U. nations with a malicious Windows Shortcut (LNK) chain that bypassed Microsoft Defender SmartScreen...
APT28 Windows Shell LNK campaign targeting Ukraine and E.U. nations
CampaignAbout this happening: A December 2025 APT28 campaign targeted Ukraine and E.U. nations with a malicious Windows Shortcut (LNK) chain that bypassed Microsoft Defender SmartScreen...
Windows BlueHammer local public exploit privilege-escalation flaw
Vulnerability
H score47
First: 06.04.2026 22:19
Last: 06.04.2026 22:19
Sources 1
About this happening:
BlueHammer (CVE-2026-33825) is a Microsoft Defender local privilege-escalation vulnerability that Microsoft patched on April 14 but that has since been abused in *...
Windows BlueHammer local public exploit privilege-escalation flaw
VulnerabilityAbout this happening: BlueHammer (CVE-2026-33825) is a Microsoft Defender local privilege-escalation vulnerability that Microsoft patched on April 14 but that has since been abused in *...
Latest development: 23.04.2026 14:05
CISA added CVE-2026-33825, known as BlueHammer, to the Known Exploited Vulnerabilities Catalog and ordered Federal Civilian Executive Branch agencies to patch Windows and Microsoft Defender systems within two weeks, with remediation due by May 7, after evidence that attackers were exploiting the flaw in zero-day attacks.
Timeline
-
16.06.2026 17:17 2 articles · 29d ago
GhostTree NTFS junction loops evade recursive Windows scans
Technical Analysis UpdateResearchers describe GhostTree and GhostBranch, which abuse NTFS junctions with no admin privileges to create recursive loops that generate effectively infinite Windows paths, making recursive folder scans and some EDR products hang and leaving malware unexamined. The technique was tested against Windows Defender, reported to Microsoft, and later patched.
Show sources
- GhostTree Attack Abused Recursive Windows Junctions to Hide Malware — www.bleepingcomputer.com — 16.06.2026 17:17
- GhostTree Attack Abused Recursive Windows Junctions to Hide Malware — www.bleepingcomputer.com — 16.06.2026 17:17