Hackers Hide Microsoft Defender Exclusions From Admins to Evade Antivirus Scans
Huntress warns attackers hide Microsoft Defender exclusions so malware stays unscanned and invisible to admins.
62
Malware
WhisperGate
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenAug 17, 2026
- Last mentionedOct 1, 2026
Timeline
3 articles · newest firstDefender Exclusion Abuse: How Attackers Hide Malware from MDAV
Huntress details how attackers abuse Microsoft Defender exclusions to hide malware from scans.
48
Threat Brief: Ongoing Russia and Ukraine Cyber Activity
Ukrainian government sites were defaced via OctoberCMS CVE-2021-32648 while Microsoft-attributed actor DEV-0586 deployed destructive WhisperGate malware.
78
Related CVEs
by mentions- CVE-2021-3264891%9.1Authentication Bypass in October CMS Password Reset Enables Account Takeover
Appears with
- Microsoftvendor · 3
- Huntressorganization · 2
- Microsoft Defender Antivirusproduct · 2
- Microsoftorganization · 2
- GootKitmalware · 2
- Muddled Librathreat actor · 1
- Cortex XDRproduct · 1
- OctoberCMSproduct · 1
- Palo Alto Networksvendor · 1
- Palo Alto Networksorganization · 1
- Windows Defenderproduct · 1
- Ukrainian governmentvictim · 1
- DEV-0586threat actor · 1
- OctoberCMSvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.