New “Download More RAM” Attack Breaks Windows VBS and Disables EDR Protections

A newly disclosed Windows attack technique dubbed “Download More RAM” can undermine Virtualization-Based Security (VBS) , bypass Hypervisor-Protected Code Integrity (HVCI), and disable endpoint defenses including Microsoft Defender and third-party EDR products. Documented by USENIX, the attack does not exploit a conventional Windows kernel vulnerability. Instead, it targets an overlooked weakness in certain consumer DDR4 and DDR5 memory modules: writable Serial Presence…