Cyberpress

EDRStartupHinder Tool Blocks Antivirus and EDR at Windows 11 25H2 Startup

First seen 12 Jan 2026, 08:57 UTC • Cybersecuritynews

•24.3

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

A new tool named EDRStartupHinder has been unveiled by security researcher TwoSevenOneT. This tool is designed to block antivirus and EDR services at startup on Windows 11 25H2 by redirecting critical System32 DLLs, specifically demonstrated on Windows Defender. The tool is part of a series of EDR evasion tools developed by the researcher.

How this analysis works

Attack Flow

Continue Reading

Google Addresses Eighth Chrome Zero-Day Vulnerability in 2025 China-linked Cyber Group Expands Targeting to Southeastern Europe China-Nexus APT UAT-7290 Targets South Asia Telecoms in Cyber Espionage Campaign China-linked UAT-7290 Targets Telcos in Cyberespionage Campaign UAT-7290 Cyber Espionage Targets South Asian Telecoms APT28 Exploits MSHTML Zero-Day Vulnerability in Windows

EDRStartupHinder Tool Blocks Antivirus and EDR at Windows 11 25H2 Startup

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading