Published a writeup on bypassing Faceit kernel-mode anti-cheat via BYOVD — abusing a signed OpenText/EnCase forensic driver to read process memory from ring-0, with zero detections. The same driver was independently documented by Huntress in March 2026 being used in enterprise EDR-kill campaign