New GhostTree Attack Causing EDR Products to Hang and Leave Files Unscanned

Cybersecuritynews •Guru Baran • May 21, 2026

A novel evasion technique called GhostTree, which exploits NTFS junctions to create recursive directory loops. Uncovered by Varonis Threat Labs, this method traps Endpoint Detection and Response (EDR) scanners in infinite paths, causing them to hang and ignore malicious payloads. NTFS junctions function as advanced shortcuts that redirect applications from one directory to another seamlessly. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GhostTree Attack Disrupts EDR Tools, Leaving Files Unscanned The GhostTree attack technique, disclosed by Varonis Threat Labs, exploits NTFS junctions to create recursive directory structures that cause Endpoint Detection and Response (EDR) tools to hang. This evasion method leads to unscanned files on Windows systems, allowing malicious payloads to bypass detection. The attack has raised significant concerns among cybersecurity professionals due to its potential to undermine security measures. Currently, there are no known patches or mitigations available to address this vulnerability. Organizations using EDR tools are advised to monitor their systems closely for unusual behavior. The full scope of the impact remains unclear, but the technique poses a serious risk to endpoint security. As of now, no specific CVEs have been associated with this attack. 2 sources 63

New GhostTree Attack Causing EDR Products to Hang and Leave Files Unscanned

The full story

Extracted Entities

Attack Types (1)

Platforms (1)