how to stop symantec endpoint protection in windows 10

Witchetty’s activity was characterized by the use of two pieces of malware, a first-stage backdoor known as X4 and a second-stage payload known as LookBack.

Witchetty was first documented by ESET in April 2022, who concluded that it was one of three sub-groups of TA410, a broad cyber-espionage operation with some links to the Cicada group (aka APT10). The attackers exploited the ProxyShell ( CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) and ProxyLogon ( CVE-2021-26855 and CVE-2021-27065) vulnerabilities to install web shells on public-facing servers before stealing credentials, moving laterally across networks, and installing malware on other computers. In attacks between February and September 2022, Witchetty targeted the governments of two Middle Eastern countries and the stock exchange of an African nation. Among the new tools being used by the group is a backdoor Trojan (Backdoor.Stegmap) that employs steganography, a rarely seen technique where malicious code is hidden within an image.

Please contact the 24/7 IT Help Desk if you have questions or need assistance transitioning your device to Defender for Endpoint.The Witchetty espionage group (aka LookingFrog) has been progressively updating its toolset, using new malware in attacks on targets in the Middle East and Africa. All devices still running a University-licensed version of Symantec will stop receiving virus definitions and security updates after this date, rendering them vulnerable to security threats. The limited extension of the University’s Symantec license expires on Monday, June 14, 2021.

Symantec stopped providing virus definitions and security updates after the University’s license expired on June 13, 2020, except for a small number of devices that received a limited, one-year license extension. Doing so ensures your devices remain protected against the latest security threats and ensures the University remains compliant with its licensing agreements. If you are still using Symantec Endpoint Protection, please upgrade to Microsoft Defender for Endpoint (formerly known as Defender ATP) on University-owned devices or an alternative antivirus solution on personal devices. As we communicated last year, the University replaced Symantec Endpoint Protection with Microsoft Defender ATP as its enterprise antivirus solution last year.

How to stop symantec endpoint protection in windows 10