EDR-Redir V2: Blind EDR With Fake "Program Files"

Reddit •/u/Cold-Dinosaur • November 1, 2025

EDR-Redir V2 can redirect entire folders like "Program Files" to point back to themselves, except for the folders of Antivirus, EDR. This means that other software continues to function normally, while only the EDR is redirected or blocked. submitted by /u/Cold-Dinosaur [link] [ ]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

EDR-Redir V2 Evades Detection by Manipulating Program Files EDR-Redir V2 is a cybersecurity threat that can redirect folders like 'Program Files' to evade detection by Endpoint Detection and Response (EDR) systems. This tactic allows the malware to function normally while blocking access to EDR and antivirus software, compromising system security. Affected systems may remain vulnerable as legitimate software continues to operate without interruption. 2 sources 10

EDR-Redir V2: Blind EDR With Fake "Program Files"

The full story

Extracted Entities

Attack Types (1)

Malware (1)