Malware authors have discovered a sophisticated method to hide their tools from security systems by exploiting Windows symbolic links, particularly through a legitimate Windows feature called bind links. Researchers at Bitdefender revealed in July 2026 that attackers can redirect file system operations to disguise malicious code as trusted system processes, making detection by Endpoint Detection and Response (EDR) tools and antivirus software extremely difficult. When an attacker with administrative access creates a bind link pointing to attacker-controlled files, the kernel-level redirection mechanism implemented by bindflt.sys effectively cloaks the malware from security scanning, allowing it to operate under a trusted identity.
The exploit works because security tools typically rely on monitoring file operations and process behavior. By using bind links to hijack these operations, attackers can execute malicious payloads while the security infrastructure sees only legitimate system activity. A practical example of this attack involves using bind links to intercept PowerShell script execution and bypass AMSI (Antimalware Scan Interface), allowing malicious scripts to load without triggering any antivirus detection mechanisms. This represents a fundamental flaw in how current security tools correlate file system operations with threat detection.
Table of Contents
- How Windows Bind Links Enable Malware Concealment
- The Cascade of Bypassed Security Controls
- Attack Techniques Targeting Specific Security Systems
- Vulnerability Scope and Affected Systems
- Detection and Monitoring Challenges
- Patch History and Microsoft’s Response
- Implications for Enterprise Defense Strategy
How Windows Bind Links Enable Malware Concealment
Bind links are a legitimate Windows feature designed for legitimate system administration tasks, but when repurposed by attackers, they create a kernel-level invisibility cloak. Implemented through the bindflt.sys driver, bind links function as transparent redirection mechanisms that alter how the file system resolves paths. When an attacker creates a bind link pointing to malicious files, the operating system redirects all operations intended for a legitimate system file to the attacker’s malware instead, but security monitoring tools that scan the disk directly only see the legitimate file path. The critical distinction between bind links and traditional symbolic links is that bind links operate at the kernel level rather than the NTFS level, making them particularly difficult for security software to detect and intercept.
Traditional antivirus solutions were designed to monitor NTFS symlinks, but bind links bypass these monitoring mechanisms entirely. An attacker can create a bind link that redirects Windows Defender’s quarantine pipeline operations or EDR agent calls to execute arbitrary code with SYSTEM privileges, essentially turning the security tool’s own processes into delivery mechanisms for malware. What makes this especially dangerous is that the legitimate use of bind links means Windows administrators and legitimate applications depend on them for normal operations. Security teams cannot simply disable bind links without breaking system functionality, creating a predicament where the feature cannot be blocked outright without introducing additional operational problems.
The Cascade of Bypassed Security Controls
Bitdefender researchers demonstrated that bind link exploitation can defeat multiple layers of Windows security simultaneously. AppLocker, which restricts which applications can execute, can be bypassed by redirecting execution through a trusted process. Windows Firewall’s monitoring capabilities can be circumvented by hijacking network operation calls. Sysmon, the system monitoring tool that many organizations rely on for threat detection, can be evaded by redirecting the system calls it monitors. one particularly alarming demonstration showed researchers executing Invoke-Mimikatz, a tool commonly used to steal credentials, while the operating system reported that the execution came from a trusted system process.
This means network-based threat hunting queries looking for Mimikatz execution patterns would find nothing, endpoint detection rules designed to catch credential theft would not trigger, and security analysts reviewing logs would see only benign system activity. The bind link redirected the malicious operation so thoroughly that it appeared as a legitimate Windows process to every monitoring system. The limitation of current defenses is that they were architected before bind links became weaponized. Most EDR solutions monitor at the user-mode level or through kernel callbacks, but bind links operate at a layer that redirects these operations before they reach the monitoring points. This architectural gap means even well-maintained security stacks with the latest signatures cannot detect bind link-based attacks because they are not monitoring the right layer of the file system.
Attack Techniques Targeting Specific Security Systems
AMSI.dll, Microsoft’s Antimalware Scan Interface, became a frequent target for exploitation through bind links. Researchers demonstrated that by creating a bind link to hijack PowerShell’s AMSI.dll import, attackers could load malicious versions of the scanning library without triggering any detection. PowerShell would call what it believed was the legitimate AMSI library, but the bind link would redirect to the attacker’s version that simply approves all scripts as safe. The script execution pipeline would proceed without any security scanning whatsoever. Windows Defender’s file quarantine and remediation workflows present another vector.
When Windows Defender attempts to remediate an infected file, it operates with SYSTEM privileges to write to protected system directories. Attackers can place NTFS directory junctions in strategic locations that redirect Defender’s remediation operations to create arbitrary files with SYSTEM privileges or to execute code as NT AUTHORITY\SYSTEM. This transforms Defender’s own remediation process into a privilege escalation mechanism for the attacker. The RoguePlanet exploit, detailed in a proof-of-concept released on June 10, 2026, demonstrated exactly this attack pattern. An unprivileged user could achieve full SYSTEM privileges by creating junctions within Windows Defender’s quarantine pipeline, and the attack required no kernel exploits or administrator rights. This fundamentally altered the threat model for Windows systems because it meant an attacker who merely gained user-level access to a machine could escalate to SYSTEM through security tools that should have been protective barriers.
Vulnerability Scope and Affected Systems
Windows 10 starting with version RS4 (released in April 2018) and all versions of Windows 11 are vulnerable to bind link-based attacks, but with a critical caveat: the attacker must already have administrator access to create the bind links. This is not a remote code execution vulnerability that allows unauthenticated attackers to immediately compromise systems, but rather a post-exploitation technique that becomes available once an attacker has achieved elevated privileges. However, the RoguePlanet and RedSun exploits demonstrated that unprivileged users can escalate to administrator or SYSTEM level through bind link manipulation of security tools. The RedSun exploit specifically targets the Windows Defender servicing stack and its file remediation workflow. It allows unprivileged users to achieve arbitrary file writes to C:\Windows\System32, the most sensitive directory on Windows systems where operating system executables reside.
This represents a complete bypass of Windows security boundaries for users who should have limited privileges. The attack demonstrates that bind link vulnerabilities are not merely EDR evasion techniques but also privilege escalation mechanisms with severe security implications. The distinction between pre-exploitation and post-exploitation matters for defense prioritization. Organizations cannot rely on perimeter defenses to stop bind link attacks because the attack assumes an attacker is already inside the system. The critical intervention point is preventing the initial compromise that gives an attacker the foothold needed to execute bind link attacks.
Detection and Monitoring Challenges
Detecting bind link-based attacks through conventional monitoring is significantly hampered by the nature of the attack. Standard EDR solutions monitor process behavior, network connections, and file access patterns, but when these operations are redirected at the kernel level through bind links, the monitoring points see only legitimate activity. A bind link attack might show as a legitimate Windows Update operation or a system maintenance task in all logs, making detection through signature-based or behavioral-based rules extremely difficult. One fundamental limitation is that bind links themselves are not inherently malicious.
Legitimate applications create and use bind links for normal operations, particularly in containerized environments and sandboxed applications. Security teams cannot establish a blanket detection rule that flags all bind link creation or modification because this would generate excessive false positives and potentially interfere with legitimate system operations. The same technique that conceals malware also supports legitimate functionality. Organizations attempting to detect bind link abuse must instrument monitoring at the bindflt.sys driver level or rely on specialized behavioral analysis that correlates unexpected process identities with file access patterns. Most conventional security tools were not designed with this level of forensic capability, meaning organizations using standard EDR solutions may have bind link attacks occurring without detection even if they believe they have comprehensive visibility.
Patch History and Microsoft’s Response
Microsoft addressed related vulnerabilities through its July 2026 Patch Tuesday release. CVE-2026-50526, a high-severity flaw in .NET, was patched on July 14, 2026, closing a vulnerability that allowed local attackers to manipulate file paths via symbolic links. Additionally, CVE-2026-50412, a stack-based buffer overflow in Windows NTFS affecting Windows 10 and Server 2025, was also patched in July 2026.
These patches represent Microsoft’s attempt to address the expanding attack surface created by symbolic link and directory junction exploits. However, these patches address only specific vulnerabilities, not the fundamental design issue that bind links can be weaponized for security evasion. The April 2025 patch for CVE-2025-21204 addressed Windows Defender’s vulnerability to symbolic link attacks in its servicing stack, yet subsequent exploits like RoguePlanet and RedSun demonstrated that attackers continue finding new angles through which to weaponize the bind link mechanism. Each patch closes a specific door, but the overall architecture remains vulnerable.
Implications for Enterprise Defense Strategy
Organizations must recognize that bind link-based attacks represent a new class of post-exploitation technique that current defensive strategies were not designed to counter. The attacks do not require sophisticated zero-day vulnerabilities or advanced kernel-mode exploitation; instead, they rely on weaponizing legitimate Windows features that provide essential system functionality.
Standard hardening practices like disabling PowerShell or restricting administrator access remain important, but they do not address the specific threat posed by bind link manipulation. The convergence of multiple exploit techniques in 2026, including RoguePlanet, RedSun, and the various CVEs patched by Microsoft, demonstrates that this is not an isolated problem but rather an emerging exploitation trend. Security teams should prioritize understanding bind link capabilities, implementing application whitelisting that monitors for unexpected process behavior regardless of what process identity is reported, and considering kernel-level monitoring solutions specifically designed to detect file system redirection attacks.