Uncensored Local Qwen Model Bypasses EDR in LSASS Dump Test

Project Black's Eddie Zhang says an uncensored, locally hosted Qwen3.8-27B variant revised a credential dumper until it evaded two EDR products in his lab.

According to GBHackers News and Cyber Press, Project Black researcher Eddie Zhang demonstrated on September 24 that a locally hosted, uncensored AI model could help generate a Windows LSASS credential-dumping utility that reportedly ran without detections across two EDR products in laboratory testing. LSASS is a high-value Windows process because, depending on configuration, it may hold password hashes or plaintext credentials that attackers use for lateral movement after gaining administrative access. GBHackers News reports the uncensored derivative of Qwen3.8-27B ran locally on a workstation with two NVIDIA RTX 4090 GPUs, and that its model card advertises "0/465 Refusals" as an "Aggressive" variant with refusal behavior removed.

The reversal at the heart of the experiment is which models cooperated. Cyber Press reports that mainstream Claude variants — Opus 5, Opus 4.8, and Sonnet 5 — refused the request entirely, even though Zhang's organization was reportedly approved for Anthropic's Cyber Verification Program. An open-weight DeepSeek v4 Flash 0731 was more willing and produced a working proof-of-concept: it accepted a target process ID, created a suspended clone of the target via reflection-based techniques, generated an in-memory minidump, XOR-encrypted the data, and wrote it to disk, and Cyber Press notes the dump was validated with pypykatz as containing usable credential material. But that early version was caught by endpoint tooling. Only after asking the uncensored local Qwen derivative simply to make the executable "more stealthy" did the output reportedly go undetected.

GBHackers News reports that the AI-generated revisions altered several behavioral and static indicators that commonly drive endpoint detections: less suspicious process-spawning behavior, lower process-access permissions against the target, randomized sleep intervals during dump generation, different output paths and filenames, and removal or obfuscation of embedded strings. Both outlets stress the caveats: neither names the tested EDR vendors, and Cyber Press emphasizes the test ran in a lab against production environments rather than claiming a universal bypass, since detection effectiveness varies with product, configuration, telemetry, and Windows protections. The result should be treated as a point-in-time lab observation, not proof that every EDR platform can be bypassed.

The defensive problem is that the individual evasion tricks are not new — attackers have long tuned access rights, delayed activity, encrypted artifacts, and modified code signatures — but a guardrail-free local model can accelerate that iteration dramatically. Project Black characterized the experiment as evidence, per Cyber Press, that inexpensive rented compute or a local GPU setup makes customized evasion development far more accessible, and GBHackers News notes such a model is also outside cloud-provider safeguards, account controls, and prompt-level monitoring. Both outlets recommend treating EDR as one layer rather than the sole barrier: limit local admin rights, enable Credential Guard, restrict debugging privileges, monitor suspicious LSASS access, abnormal handle activity, and dump-like file creation, and enforce least-privilege and segmentation against lateral movement.