OPERATION VADER — Book Report

How Social Engineering Completes the Rootkit Kill Chain
George Wu / 22DIV — CSEC Tactical Cyber Operations — June 2026
Source Material: ASF Social Engineering Guide (Ch.23) × VADER Rootkit (14 Engagements, 53 Findings)
Section 01

Thesis

A rootkit without delivery is a knife in a locked drawer. VADER solves Phases 1 through 6 of the kill chain — telemetry blinding, injection, privilege escalation, C2, staged delivery, and evidence cleanup. But Phase 0 — initial access — remains unsolved by code alone.

The ASF Social Engineering Guide (CSEC Chapter 23) provides the missing layer. It does not hack machines. It hacks the human operating system — the decision-making firmware that no patch can update. This report analyses how the ASF framework completes VADER's technical kill chain by solving the delivery problem.

"You do not hack machines. You hack the person operating the machine. The machine has patches. The human does not." — ASF Core Doctrine
Section 02

Two Kill Chains

Every offensive operation runs two parallel kill chains. The technical chain is what the code does after execution. The human chain is what gets the code executed in the first place. Most security research focuses exclusively on the technical chain. The ASF guide argues this is backwards — the human chain has a 70% success rate against untrained targets, while technical defenses are iteratively patched.

Technical Kill Chain (VADER)
PhaseComponentStatus
0Initial AccessUNSOLVED
1AMSI Bypass (HWBP)CONFIRMED
2ETW Bypass (HWBP)CONFIRMED
3Privilege EscalationCONFIRMED
4Process InjectionCONFIRMED
5HTTP StagerBUILT
6Anti-ForensicsBUILT
Human Kill Chain (ASF)
PhaseTechniqueExploit
ReconObservationSocial mapping
PretextFabricated scenarioHelpfulness
TrustCalibrated deliverySocial obligation
HandoffUSB / email / linkCuriosity
ClickVictim executesAuthority
CoverMaintain facadeHabit
RevealControlled disclosureDemonstration

The technical chain is deterministic — once the code runs, every phase executes predictably. The human chain is probabilistic — it depends on the target's emotional state, trust level, and decision-making pattern. The ASF guide quantifies this: 70% of humans decide emotionally, applying logic retroactively to justify the emotional decision.

Section 03

ASF Doctrine Analysis

The Core Axioms

The ASF framework operates on three axioms that map directly to offensive security operations:

  1. Reality Precedes Morality. You cannot defend against attacks you refuse to understand. The operator studies the attack to build the defense. Refusing to learn social engineering because it "feels wrong" leaves the human attack surface permanently unpatched.
  2. The China Principle. Peaceful rise backed by credible threat projection. Capability without deployment is deterrence. The rootkit exists as proof-of-concept, not as a weapon in active use. The social engineering guide documents the techniques, not to execute them against innocents, but to teach defenders what to watch for.
  3. Controlled Hate as Fuel. The doctrine distinguishes between directed energy (disciplined output over months of research) and destructive impulse (chaotic one-time action). VADER represents the former — 14 engagements, 53 findings, every failure turned into a documented improvement.

The Human Vulnerability Table

The ASF guide maps human psychological vulnerabilities to specific attack techniques, mirroring how MITRE ATT&CK maps technical vulnerabilities to exploit techniques:

Human VulnerabilitySE TechniqueVADER Integration
Desire to be helpful Pretexting "Check if this PDF opens" → LNK launches stager → stager fetches dark_room + inject payload
Curiosity Baiting USB labeled "Payroll" in parking lot → victim inserts → autorun or manual execution of stager
Authority compliance Vishing "IT needs you to run this diagnostic" → victim runs stager believing it is sanctioned
Trust in familiar systems Watering hole Compromise a site the target visits → serve stager to specific IP ranges only
Social proof Group targeting "Everyone else already ran it" → social pressure overrides individual caution
Fear of rudeness Tailgating Physical access to machine → 30 seconds to plug USB and execute stager
"The bait preys on the victim's desire to prey." — ASF on baiting. The victim who picks up the "free" USB drive thinks they found something valuable. They are the product, not the consumer.
Section 04

The Convergence — Where Both Chains Meet

The ASF guide's classroom demonstration scenario maps exactly to VADER's kill chain. Here is the complete operation from first contact to full compromise, combining both chains:

HUMAN CHAIN TECHNICAL CHAIN ───────────── ─────────────── T-7d Observe target (social recon) Scan target profile (vader_recon.ps1) T-1d Prepare pretext ("check this PDF") Compile: dark_room + inject + stager T-0 Deliver USB to target USB contains: LNK spoof + stager + payloads T+0s Victim double-clicks "PDF" LNK launches hidden PowerShell T+2s Victim sees dummy PDF open vader_stager.exe fetches dark_room.exe T+5s Victim reads the dummy PDF Dark room: DR0=AMSI, DR1=ETW → BLIND T+8s Victim continues class normally vader_inject.exe --spawn (blind PowerShell born) T+12s Operator shows no reaction HWBP armed on all threads, VdrWatch running T+30s Target is fully compromised C2 shell connected, SYSTEM pending privesc T+3m Operator chooses reveal moment Canary files confirm execution chain T+5m "Your machine is compromised." VNC/shell displayed to room POST-OPERATION: T+10m Controlled disclosure vader_clean.exe (logs, prefetch, timestamps) T+15m Victim understands the lesson mutate.py (rotate signatures for next op)

The human chain's job is to get the victim to T+0s — the double-click. Everything after that is deterministic. The ASF guide's pretext engineering, trust calibration, and body language protocols exist solely to make that single click happen. VADER exists to make everything after that click invisible and unstoppable.

Why The Click Always Comes

The ASF guide identifies three conditions that guarantee the click:

  1. The pretext matches the operator's social label. A "student" asking for help with a PDF is expected behavior. No alarm triggers. If the same student said "run this executable for me," the pattern breaks and suspicion activates.
  2. The request is small and reversible in the victim's mind. "Just check if it opens" feels like a 5-second favor. The victim's risk assessment concludes: low effort, low danger, high social reward for helping.
  3. The emotional decision is made before the logical evaluation. 70% emotional processing means the click happens before the victim thinks "should I run files from other people?" By the time logic engages, the file is already executing.
Section 05

Defensive Analysis — What Stops Both Chains

If the attack operates on two chains, the defense must also operate on two chains. Technical controls alone fail because the human chain bypasses them. Security awareness alone fails because VADER's technical chain defeats every automated defense after the click.

Attack PhaseTechnical DefenseHuman DefenseCombined Effectiveness
Pretext delivery None — conversation, not code Security awareness training: never run files from peers Moderate — training decays, social pressure persists
USB insertion Disable USB autorun, WDAC application whitelisting "Never plug in unknown USB drives" High — WDAC blocks unsigned execution entirely
Stager execution SmartScreen, Mark-of-the-Web, application control Recognize that "PDFs" don't need admin prompts High — MotW + SmartScreen is the strongest barrier
Dark room (HWBP) None observed — Defender blind spot N/A — post-click, human no longer relevant None — no current defense at this layer
Process injection EDR monitoring CreateRemoteThread + SetThreadContext N/A EDR-dependent — Defender alone doesn't catch it
Privilege escalation Fix ACLs on SYSTEM service directories. Don't install Wondershare. N/A High — remove the vulnerability, remove the vector
Evidence cleanup Forward logs to SIEM before they can be cleared N/A High — off-box logging defeats local cleanup

The Defense Gap

The table reveals a pattern: defenses are strongest at the boundary (USB insertion, file execution, network egress) and weakest once code is running (HWBP bypass, injection, in-memory operations). The ASF social engineering chain specifically targets that boundary — not with technical exploits, but with emotional ones that make the victim voluntarily open the door.

The single most effective defense against the combined VADER + ASF attack is Windows Defender Application Control (WDAC) — application whitelisting that blocks all unsigned executables regardless of how they arrive on the machine. WDAC doesn't care about pretexts, trust windows, or emotional decisions. It cares about code signatures. The stager is unsigned. WDAC stops it dead.

The problem: WDAC is an enterprise feature. Home users don't have it. George's flagship machine doesn't have it. Most targets in the real world don't have it. Which means the human chain remains the most reliable delivery mechanism against consumer Windows.

Section 06

Key Findings

Finding 1 — The Human OS Has No Patch Tuesday

Microsoft patches technical vulnerabilities weekly. The human vulnerabilities exploited by social engineering — helpfulness, curiosity, authority compliance, fear of rudeness — are firmware-level. They cannot be patched. They can only be mitigated through training, and training decays over time while the vulnerabilities persist indefinitely.

Finding 2 — Phase 0 Is The Hardest And Cheapest Phase

VADER's technical kill chain required hundreds of hours of C programming, reverse engineering, and iterative testing against Defender. The social engineering delivery requires a USB stick, a convincing sentence, and 30 seconds of physical proximity. The asymmetry is staggering: the most expensive phase to build is the cheapest phase to execute, and vice versa.

Finding 3 — The Reveal Is The Report

The ASF guide's "reveal" protocol mirrors responsible disclosure. The operator demonstrates capability, explains the methodology, and provides documentation. The classroom reveal (“your machine is compromised”) is structurally identical to an MSRC submission (“your product has a vulnerability”). Both require proof-of-concept, both require controlled disclosure, and both convert demonstrated capability into institutional respect.

Finding 4 — Capability Without Restraint Is Terrorism

The ASF guide draws an explicit line: “The line between Operator and terrorist is not technical skill. It is restraint.” VADER is built. It works. It is not deployed against anyone who hasn't consented. The social engineering guide documents techniques for defensive awareness, not for attacking innocents. The entire research project exists within the boundary of authorized academic work on owned hardware with responsible disclosure.

Section 07

Conclusion

VADER is a complete technical weapon. The ASF Social Engineering Guide is its delivery system. Together they represent the full spectrum of offensive capability: from the psychological manipulation that gets a victim to click, through the telemetry blinding that hides the execution, to the privilege escalation that takes the machine, to the evidence cleanup that erases the trail.

The research proves three things:

  1. Windows Defender has an architectural blind spot in hardware breakpoint monitoring (Finding #36, MSRC potential). Debug register manipulation targeting security functions generates no telemetry.
  2. User-mode evasion chains are sufficient to defeat Defender's entire detection stack when properly composed. Kernel access is not required.
  3. The human attack surface is the ultimate bypass for every technical control. No amount of endpoint hardening matters if the operator can convince the human to voluntarily execute the payload.

The defense recommendation is layered: WDAC for technical control (blocks unsigned execution regardless of delivery method), security awareness for human control (reduces click probability), and SIEM for detection (catches what gets through). Any single layer alone is insufficient. VADER + ASF proves that.

"Survive through capability, not through acceptance." — ASF Core Axiom 2. The operator does not ask to be understood. The operator builds until understanding is the only option.