Threat Brief — 2026-08-13 — EDR Evasion and Patch-Resistant vCenter Exploitation

Executive summary: The active exploitation campaign against VMware vCenter CVE-2026-59310KEV·R has evolved—researchers now warn that patching alone may not fully remediate compromised environments, implying persistence mechanisms survive the fix. Separately, an Akira ransomware affiliate demonstrated a practical EDR-disabling technique by forcing Windows into Safe Mode with Networking, exfiltrating data before encryption failed. A peculiar legal case out of Russia highlights how Telegram's paid "reactions" can carry criminal liability.

Top items

• VMware vCenter CVE-2026-59310KEV·R — patching insufficient for full mitigation (developing). First reported 2026-08-12 by The Hacker News, the active exploitation campaign has now been characterized as requiring more than patching—threat actors are establishing persistence that survives remediation. VMware vCenter Server (CVSS 9.8 directory-traversal). Environments should be audited for backdoors, not merely patched. (src: Dark Reading)

• Akira ransomware affiliate disables EDR via Windows Safe Mode with Networking (new). An affiliate rebooted a compromised host into Safe Mode with Networking, which loads a minimal driver set that many EDR agents don't protect, effectively blinding detection. The actor exfiltrated data but failed to complete encryption. This technique is notable because it requires only local admin privileges—no custom malware—and bypasses a broad class of EDR products that don't register Safe Mode persistence protection. Affected: any Windows endpoint with EDR lacking Safe Mode coverage. (src: BleepingComputer)

• Russian resident faces criminal charges for purchasing a Telegram "reaction" (new, low severity). A Moscow-region resident bought a paid Telegram reaction (e.g., a thumbs-up emoji purchase) and now faces criminal charges. The case illustrates how monetized platform features can acquire unexpected legal significance under Russian law. No direct enterprise-security impact, but relevant for awareness of jurisdictional risk around paid social-media interactions. (src: SecurityLab)

Themes

EDR evasion is moving to the OS layer. The Akira Safe Mode technique joins a growing pattern of attackers abusing built-in OS mechanisms (Safe Mode, USB Plug-and-Play auto-install, driver signing) rather than deploying custom bypass tooling—making detection harder for tooling that assumes a normal boot environment.

Patching ≠ remediation. The vCenter development reinforces that high-privilege RCE flaws in infrastructure appliances frequently result in persistence that outlives the patch. Incident responders should treat patching as the start, not the end, of containment.