“Microsoft still has to address the Windows Update takeover issue.”
SafeBreach’s Alon Leviev downgrades ci.dll to an old unpatched copy, and a fully updated Windows 11 23H2 loads unsigned kernel drivers. Microsoft dismissed the Windows Update takeover because it did not cross a defined security boundary. The attack needs admin rights, which every attacker installing a rootkit already has. Fully patched means nothing when the patch can be rolled back.