Hey guys, welcome back to another episode. We are talking about AI being used by Microsoft security researchers to find flaws faster. And we’re seeing malware get more sophisticated by the day.
Coffee loader malware is getting very, very smart at evading.
All that in this episode of Exploit Brokers.
Today, we’re facing an unprecedented array of data breaches, hacking attempts, and surges in digital crime. Why is there such a widespread amount and how little is noticed in our everyday lives? Malware, dark sites, brute forcing, zero day, script kiddies, and nation state hackers are all on the rise. Learn more about the threats we face and gain a bit more knowledge than yesterday.
So guys, this is your host Cipherceval, and welcome back to another episode. If you can do me a favor because it helps the channel grow—if you’re on YouTube, hit that like, subscribe, and bell notification icon. And if you’re on something like a podcast platform like Spotify or Apple Podcasts, give a follow or subscribe and a five-star review, if you think we deserve it.
With that, let’s jump into it.
So our first article is by Bleeping Computer: Microsoft uses AI to find flaws in Grub2, U-Boot, Barebox bootloaders. So what is a bootloader? Well, whenever you start up your computer, the piece of software that runs before your operating system is the bootloader. The bootloader kind of does what it sounds like—you’re loading up something, you’re loading up the operating system, kernels, and whatever the OS needs to be able to run.
If you can get malware into the bootloader, that’s bad for you. As malware creators or whatever, that’s really beneficial for them, which is why I want to talk about this—because it’s one of the things that you don’t necessarily see often. But when we hear about it, it’s just really cool.
So Microsoft used its AI-powered Security Copilot to discover 20 previously unknown vulnerabilities in the Grub2, U-Boot, and Barebox open-source bootloaders. Grub2, or Grand Unified Bootloader, is the default bootloader for most Linux distributions, including Ubuntu. While U-Boot and Barebox are commonly used in embedded and IoT devices.
So 20 previously unknown vulnerabilities is pretty much seeing 20 zero days, and this is pretty impressive, right? We are getting a lot of flack for AI generation where you are seeing artists’ work get taken from them and used for training purposes, and then the AI can essentially just create “quote unquote” like an artist. But here, what we’re seeing is AI that’s been trained more on the security side—which, granted, it might have still taken proprietary code or copyrighted code. We never know where some of the training data comes from. But here, it’s taking code and it’s just being used from an analysis standpoint, which I find pretty cool.
Now, there is still some generation because it’s giving some text feedback. And if you think of the way LLMs work, it’s token prediction, that kind of thing. But we won’t get into the nitty gritty of that right now. Let’s keep going.
Microsoft discovered 11 vulnerabilities in Grub2, including integer and buffer overflows in file system parsers, command flaws, and a side channel in cryptographic comparison. Additionally, nine buffer overflows in parsing squashFS, ext4, cramFS, JFFS2, and symlinks were discovered in U-Boot and Barebox, which require physical access to exploit. So squashFS, ext4, cramFS, and JFFS2 are all file systems, where symlinks are more of a file system thing, which is symbolic links.
Now, the fact that you require physical access to exploit—well, some people might be like, “Oh, well, that makes it less of a problem.” In a lot of cases, it does, and it’s mitigated by having stuff locked behind guarded areas and server rooms, all that. Just because it’s harder to get to doesn’t mean it’s still not a flaw. It’s still something that we should take seriously and try to fix.
The newly discovered flaw impacts devices relying on UEFI Secure Boot, and if the right conditions are met, attackers can bypass security protections to execute arbitrary code on the device. That is where the golden goose is. Arbitrary code execution of any point or any system is where you get so much stuff that can happen. If you can execute code, you can run shells, you can try to do anything that you might be able to do with a piece of software, which is pretty big.
Now, while exploiting these flaws would likely need local access to the device, previous bootkit attacks like Black Lotus achieved this through malware infections where it takes advantage of some of the remote capabilities to pretend like it’s local—but it’s kind of more than just that.
While threat actors would likely require physical device access to exploit the U-Boot or Barebox vulnerabilities, in the case of Grub2, which is very popular with Ubuntu, the vulnerabilities could be further exploited to bypass Secure Boot and install stealthy bootkits or potentially bypass other security mechanisms such as BitLocker, explains Microsoft. A bootkit or a rootkit—can be somewhat used interchangeably—are pieces of malware that are installed before the operating system.
This stuff is insane because if you ever hear about bootkits or rootkits, you gotta throw the whole computer away. It’s not like you have a piece of malware that’s in your registry, or a piece of malware that’s in your temp folder, or in System32 or blah blah blah. When you install the rootkit or the bootkit, a lot of them go into the UEFI or the BIOS, and when you install at that level, you’re installing pretty much on the hardware—almost. You’re installing somewhere that’s before the operating system.
If you think about the common way of getting rid of some of the nastier viruses, you hear a lot about reinstalling the operating system—do a wipe and install. Well, you can’t do that here because even if you were to wipe and install, it’s still before the operating system. So you have this case where you have a really embedded piece of malware and you gotta throw the whole computer away—essentially.
The article kind of goes over what I just said there, where it’s malicious because it takes over the boot process.
There is a lot of CVEs, so I’m going to kind of rush through them a little bit and give you just what they say.
So CVE-2024-56737, CVE-2024-56738, CVE-2025-0677, CVE-2025-0678, CVE-2025-0684, CVE-2025-0685, CVE-2025-0686, CVE-2025-0689, CVE-2025-0690, CVE-2025-1118, and CVE-2025-1125.
Now, some of these are integer overflows versus buffer overflows, and there’s even one that takes advantage of a string copy, which is pretty much—you’re talking about C programming there.
They’re all medium severity except CVE-2025-0678, which is rated as high on the CVSS v3.1 score of a 7.8.
Buffer overflows are pretty problematic because at that point, if you can take advantage of the pointer, then you can essentially get execution. If you can get execution on the remote system, you have remote code execution, and you can take over and install a shell or pop a shell, and you get more access.
Microsoft’s Security Copilot dramatically accelerated the vulnerability discovery process in a large and complex code base such as Grub2, saving approximately one week of time that would have been required for manual analysis.
Now, here’s the part where I really want to emphasize—AI, at least in its current iteration, is not a one-to-one to get rid of either software engineers or security researchers or anyone else, in my opinion. And the way I see it, it is a tool that’s best used by those who have the skillset and knowledge or who are very close to getting that knowledge.
So say someone who’s a mid trying to become a senior, a junior trying to become a mid, etc.—it’s best used by them as a tool to accelerate.
Now, that’s when you’re talking about neural networks or LLMs and stuff like that, which is where a lot of these AI tools come from.
Kind of how programming languages were meant to help people who were writing assembly and so on and so forth. It’s more useful to think of it as a tool than a straight replacement. There are still a lot of flaws, and a lot of prompting and things have to get done. So even if you say, “Oh well, you can do a lot of things even from a non-technical side,” you have to know what you’re looking for—how to guide the AI—because AI just uses predetermined stuff and can guess the next thing based off context.
Not only did the AI identify previously undiscovered flaws, but it also provided targeted mitigation recommendations that could provide pointers and accelerate the issuance of security patches, especially in open-source projects supported by volunteer contributors and small core teams.
So this is where it comes back to—when you think about stuff like ChatGPT or any of the GPT-style models, they do predictive token, which essentially means they try to figure out what the next word that they want to say is based off a kind of analysis of all the words that came before it and so on and so forth. Here, because it’s trying to figure out mitigations, it’s looking at what are these kinds of vulnerabilities, how can it relate to other vulnerabilities that it knows of the same type, and give patch recommendations on that.
Now, the sophistication level of AI—I don’t do it justice on this short podcast, right? It is an entire topic in itself. I find it super fascinating, and I’m just trying to give you a rough idea of what it is and what’s going on in context of security.
To talk about AI would be an entirely different podcast—an entirely different episode, even.
But with that, I think it’s really cool. Microsoft is definitely using AI, and they’re not the only ones. There are going to be a lot of people who are going to keep using AI to accelerate their own skills, and I find it cool. They’re able to help secure stuff that would have taken them more time. The more you can triage and the more you can get secured, the harder it’s going to be for bad actors to take advantage of it.
But with that, that’s Bleeping Computer’s article. Let’s go ahead and jump into Coffee Loader.
So in an article by Dark Reading, Coffee Loader malware is stacked with vicious evasion tricks. Next-level malware represents a new era of malicious code developed specifically to get around modern security software like digital forensics tools and EDR, new research warns.
You’ve heard me—or if you haven’t heard me and you’re new to the channel, welcome—but for those who’ve been around on the podcast for a little bit or on the episodes, you know that I’m saying we have kind of this interesting paradigm where malware gets more sophisticated consistently.
Granted, you have some stuff that goes old school and relies on social engineering or just mass numbers—the law of spam, where 1% usually will click, etc. I don’t know if it’s called the law of spam, but that’s kind of the way I know it.
Well, here we’re seeing the next leap. I read through the article before, so I want to go through it and kind of dissect it piece by piece. What I find interesting is this not only takes from other different kinds of malware, but there’s some stuff in here that I haven’t heard about before. I find it just extremely interesting.
Since last fall, well-known backdoor malware SmokeLoader has been upgraded with a new second-stage payload dropper called Coffee Loader that’s tricked out with techniques to beat endpoint security software.
A loader is essentially a piece of software that loads something else in, like an info-stealer or some kind of RAT—or Remote Administration Trojan.
New research from Zscaler Threat Labs provides a deep technical dive into Coffee Loader’s new eyebrow-raising evasion techniques.
Yeah, I would say they’re pretty eyebrow-raising. At the moment, Coffee Loader is being used to deliver shellcode for the Rhadamanthys info-stealer, the analysis showed. Coffee Loader is one of the most sophisticated malware loaders in terms of evasion, with novel techniques to bypass virtual machines, digital forensic tools, and EDRs.
The report’s author, Brett Stone-Gross, Senior Director of Threat Intelligence with Zscaler Threat Labs, says about the findings: whenever you hear some researchers say, “Oh, this is the most sophisticated thing,” sometimes they’re kind of on to something—sometimes they’re not. They’re definitely on to something.
I know I keep talking about it—it’s just really cool. So the report notes many commonalities between Coffee Loader and Smoke Loader, including a shared stage, reliance on Windows APIs, and a new bot ID that correlates computer name and serial number.
Zscaler researchers found Coffee Loader’s stack spoofing implementation most likely based on Cobalt Strike’s Boku Loader.
You have this piece of malware that’s copying from other malware. Maybe they saw it and wanted to bring it in, maybe the authors have been communicating—you never know.
But one that I found really interesting is the sleep obfuscation. So this is another Coffee Loader feature. This one doesn’t appear to have been taken from any specific malware, but there might be other malware that are doing it.
This method keeps the malware itself hidden from memory scanning software by encrypting it. So it encrypts the data and the actual code that is not being run. So whenever you do an analysis on it, it just looks like a garbled mess. This is obfuscation.
Well, when the malware wants to run, it decrypts itself, runs whatever it needs to run, and then re-encrypts itself to go back to sleep. And that’s what I found really cool—because you are taking obfuscation techniques and having them pretty much redo themselves in real time as you run, and then go back to sleep, run, go back to sleep.
Now this, in conjunction with something else called Windows Fibers, is a way that Coffee Loader is literally packed to the brim.
So let me read this subsection: They allow a single thread to have multiple execution contexts known as fibers, which can be manually switched between by the application rather than the Windows scheduler, the report added.
Coffee Loader has an option to use Windows Fibers to implement sleep obfuscation as yet another way to evade detection, since some EDRs may not directly monitor or track them.
So whenever you’re talking about an application or a program, you have things that are known as threads, and you have execution contexts. Execution context is all the memory and all the stuff it has access to within the little space of execution—I won’t bore you with any details beyond that.
And whenever you think about a thread, you’re thinking about different pieces of a program that can be split up. Now there’s something like a thread, and then something spinning off another process that’s going to do something, versus a thread which is multiple things that can be done within one process or one app.
From a programming perspective, when you create a child process, you’re giving it its own space, its own thing. When you do threads, you are still kind of sharing the resources, and it’s less overhead-intensive.
But in this case, they’re trying to bypass the Windows scheduler by using threads—or by using fibers—which sounds to me like a pseudo thread management that’s been implemented by Coffee Loader.
This is kind of on the next level. You have to understand scheduling. You have to understand different aspects. At this point, it’s much more sophisticated than just a piece of malware or a simple loader. There is so much going into this and I find it insane.
Importantly, the research highlights that Coffee Loader is packed and protected by using the target system’s GPU, which the report suspects is intended to make the malware more difficult to spot in virtual environments.
Zscaler calls the new malware packer “Armory” because it spoofs Armory Crate, which is a legitimate ASUS tool. They are using the Armory Crate, which is a legit tool, and they’re making it look like that—but then they’re pretty much packing in encrypted versions of their libraries and other stuff that they’re using.
And then when they actually need to run it, they’re pulling that out, decrypting it, and doing different stuff using the system’s GPU.
They’re using something called OpenCL, which is the Open Compute Language—something that’s pretty much implemented on all drivers by default, at least in most modern drivers by default. So it’s something that has no external dependencies.
Whenever you hear about hackers, one thing you hear about is like, “Don’t rely on Python,” because when you get into a system, there’s no guarantee that Python is there. There’s no guarantee you can install Python.
But stuff like Bash, OpenCL, C programming executables—there’s a lot of stuff that’s just inherently available in operating systems because that’s how they’re built. And OpenCL is just one of the things that gets bundled with a bunch of different things.
The system GPU, I find cool, because you have to think about GPU in a different paradigm than you would with just normal CPU-based programming, which is what most programmers will think of. When you think about GPU, you have to think about yourself as a piece of the data that needs to be processed, instead of thinking of all the data as a whole.
I know that sounds kind of complex—and it is—but it’s just the paradigm shift of the way programming is, to program something for CPU versus GPU.
Now further, Coffee Loader malware is armed with a Domain Generation Algorithm that creates a new command-and-control, or C2, domain in the case that the hardcoded list of C2 servers is unreachable.
This is also really cool if you think about it. If your domain gets brought down because of anything—like the government is bringing it down, or there’s a reason you need to burn a C2—you’re rotating C2 domains. Because the generation algorithm is in place, it knows roughly what the next one should be.
So I’m assuming it’s going to generate a few, try to reach out, get some kind of authentication or certificate or some kind of handshake that tells it, “Hey, you’ve connected.” And that allows it to pretty much programmatically find where it needs to get its next command, which is just really good future planning.
From a malware author’s perspective, there’s a lot of legitimate software that isn’t as resilient as this thing is, which is insane.
That’s roughly the full thing of the article.
As we take security more seriously, as different tools come up, as different researchers get involved—it used to be that 10, 15, 20 years ago, vulnerabilities and bugs, zero-days, and stuff like that was just stuff that would be talked about by pretty much computer programmers or computer geeks.
But now the cyber world has become so almost mainstream. There’s still a lot of fear around it, but it’s been so mainstream that it’s becoming more front-line. It’s becoming more obvious that we need to take security seriously.
And there are a lot of companies that are stepping up and putting their money where their concerns are—which is they are putting security as a major concern. Because no company wants to be the company that gets leaked, no company wants to be the company that gets a lawsuit because they had all their customer data brought on. No company wants to be under the scrutiny of the government because they had all their data leaked, etc., etc., etc.
I think there are a lot of companies that are doing good, and there’s probably a lot of companies that are in the works trying to get better. And for those that have taken strides, I applaud you 100%. And for those that are working on it, I encourage you to keep working on it.
But guys, this has been your host Cipherceval. I want to thank you for tuning in. This has been another episode of Exploit Brokers, and I’ll catch you in the next one.
Note: This is a transcript of the episode.
📢 Connect with us:
Newsletter: https://follow.exploitbrokers.com
Twitter: @ExploitBrokers
Medium: https://medium.com/@exploitbrokers
TikTok: https://www.tiktok.com/@exploitbrokers
🔗 References & Sources
- Microsoft Uses AI for Security: https://www.bleepingcomputer.com/news/security/microsoft-uses-ai-to-find-flaws-in-grub2-u-boot-barebox-bootloaders/
- CoffeeLoader: https://www.darkreading.com/threat-intelligence/coffeeloader-malware-evasion-tricks
Leave a Reply