A newly published attack framework dubbed LACUNA Chain renders every known layer of call-stack-based EDR detection obsolete by exploiting invisible gaps in Windows DLLs that unwinders cannot see, leaving defenders with only behavioral correlation as a last line of defense.
Mohamed Alzhrani (@0xmaz) published the technique on June 20, 2026, as a direct sequel to his 2024 HookChain research, marking one of the most technically significant EDR evasion disclosures of the year.
HookChain demonstrated in 2024 that 94% of analyzed EDR solutions placed no hooks above the NTDLL subsystem layer.
By combining IAT manipulation, dynamic syscall number resolution via Halo’s Gate, and indirect syscalls routed through ntdll’s own syscall;ret gadget, HookChain bypassed the majority of userland hook-based defenses at the time.
LACUNA Attack Bypasses Call-Stack-Based EDR
EDR vendors responded by abandoning userland hooks entirely and moving telemetry collection into the kernel via callbacks such as ObRegisterCallbacks and PsSetCreateProcessNotifyRoutine, alongside ETW-Ti STACKWALK mode, which captures the full call stack the moment any security-sensitive syscall crosses the kernel boundary.
With that shift, bypassing NTDLL hooks became irrelevant; the shellcode’s return address remained visible in the collected stack regardless. LACUNA Chain was built to defeat the collected stack itself.
The attack’s foundation originates from Alzhrani’s extended Ghidra analysis of RtlVirtualUnwind on Windows 11 22H2. Every Windows DLL contains uncovered address ranges gaps between consecutive RUNTIME_FUNCTION entries in the .pdata section.
When RtlLookupFunctionEntry returns NULL for an address in one of these gaps, the unwinder treats it as a leaf function, advances RSP by exactly 8 bytes, reads the next return address, and continues without flagging anything anomalous.
Alzhrani named these regions lacunae, from the Latin for “void” or “absent part.” Binary analysis revealed that ntdll.dll contains 3,913 such gaps, with 1,031 holding live executable ghost functions totaling 48,805 bytes of code with zero .pdata coverage.
win32u.dll contributes 1,242 NOP gaps between its syscall stubs, all categorically whitelisted by existing EDR module-of-origin rules.
kernelbase.dll yields 432 ghost functions, including a 238-byte ghost ending precisely at VirtualProtect‘s entry point, making fake frames placed there semantically indistinguishable from a real VirtualProtect return site.
The full LACUNA Chain assembles seven distinct components into a single layered bypass. BYOUD-Gap forms the backbone zero-modification stack spoofing that chains gap addresses as leaf frames to hide arbitrary stack depth without touching .pdata.
The ETW-Ti APC Window Attack exploits the asynchronous nature of ETW-Ti stack collection, which is delivered via USER_APC only when a thread enters an alertable wait. Keeping the thread non-alertable during sensitive operations queues all APCs until a forged chain replaces the real stack.
The Win32u NOP Gap Chain converts 1,242 uniform NOP gaps into whitelisted leaf frames, turning the defender’s own whitelist rules into an offensive primitive.
BYOUD-MF enables arbitrary RSP assignment in a single frame by exploiting UWOP_PUSH_MACHFRAME opcode 10 inside RtlVirtualUnwind, requiring no gadgets and no .pdata modification.
Mohamed Alzhrani stated that the BYOUD-RT solves the calibration problem by computing RSP distance at runtime using TEB.StackBase, making the technique fully operational inside injected shellcode at unknown stack depth.
Parameter encryption via hardware breakpoint VEH completes the chain. Syscall parameters remain encrypted at rest and are decrypted only within a VEH handler triggered at the syscall instruction, thereby defeating any inspection of what the call was made for.
Testing on Windows 11 22H2 with CET enabled, Sysmon v15, and ETW-Ti STACKWALK active confirmed full bypass against Elastic EDR, Bitdefender, and Kaspersky Endpoint Security, with shellcode executing undetected across all three.
Every detection encountered during testing came from behavioral signals, memory permission anomalies, syscall sequence patterns, and handle access rights, never from call-stack inspection.
Behavioral kernel callback correlation remains the only surviving reliable signal, but carries significantly higher false-positive rates than stack-based rules, forcing defenders into a much harder tuning tradeoff with no clean signature to anchor on. A proof of concept is publicly available on GitHub.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
