This is a notification that the update to our Windows agent’s Ultralight Core planned for GA release today, 8th of October 2025, has been postponed until Wednesday 15th of October for further investigations due issues observed in a small number of clients during Pilot phase. We apologize for the delays related to this particular release, but we are committed to making sure that we release content with the highest possible quality.

Countercept agent for macOS v25.1 & macOS 26 (Tahoe) support

We’re happy to announce that Countercept agent for macOS v25.1 supports macOS 26 (Tahoe).

The update is related to the Countercept Agent’s FSBG components. The FSBG component is responsible for the core functionality (e.g. settings management and updates) of the Countercept Agent and does not affect the components responsible for telemetry collection or response.

Product Name: Countercept Agent for Linux – FSBG

Version: 1.0.922

Pilot Availability: 06/10/2025

General Availability: 13/10/2025

Predecessor: 1.0.921

Release Purpose:

• Generic Maintenance

Customer Action Required:

• N/A

Name Changes:

• Several auxiliary files have been added in this release.
• No changes to process, or service names.

Files Updated:

• Most files are updated with this release.

New Features and Enhancements:

• N/A

Generic Maintenance:

• Changes to the functionality not utilized by Countercept.
• Minor bug fixes and improvements.

OS Support:

• AMD64
  • AlmaLinux 8.4 – 9.x
  • Amazon Linux 2
  • CentOS 7, 8
  • Debian 10, 11, 12
  • Oracle Linux 7, 8, 9 (RHCK and UEK)
  • RHEL 7, 8, 9
  • Rocky Linux 8, 9
  • SUSE Linux Enterprise Server 12 SP3 – SP5
  • SUSE Linux Enterprise Server 15
  • Ubuntu 18.04, 20.04, 22.04, 24.04
• ARMv8/AArch64
  • Debian 11, 12
  • Rocky 9
  • Ubuntu 22.04, 24.04

Please note that CentOS 6 and RHEL 6 are not supported. The Countercept Agent might break with this update, on endpoints where these operating systems are in use. WithSecure recommends upgrading these endpoints to the supported operating system versions, or switching clients to managed updates in collaboration with the WithSecure Engagement team.

The update is related to the Countercept Agent’s Ultralight Core component. Ultralight Core provides low-level functionality such as file hash calculation as part of the agent’s reporting of endpoint activity.

Product Name: Countercept Agent for Windows – Ultralight Core

Version: 2.1.20768

Pilot Availability: 01/10/2025

General Availability: 08/10/2025

Predecessor: 2.1.20648

Release Purpose:

• General maintenance

Customer Action Required:

• The Operating System should be Azure Code Signing (ACS) compliant to receive this update. See 
  
  https://community.withsecure.com/en/kb/articles/29714-changes-in-support-on-microsoft-windows-minimum-patch-level
  
  
                for more details.
  Any endpoints which are not ACS-compliant will continue to run the older version of the Ultralight Core (2.1.16183).

Name Changes:

No changes to file, process, or service names.

Files Updated:

• CapricornScanner.exe
• fshoster64.exe
• FsPisces.exe
• install.exe
• uninstall.exe

New Features and Enhancements:

• N/A

General Maintenance:

• General maintenance of functionality not utilized by Countercept.

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

The update is related to the Countercept Agent’s Sensor component. The Sensor component gathers data to be analyzed in the WithSecure backend to identify any malicious activity.

Product Name: Countercept Agent for Linux – Sensor Component

Version: 2025.2.168

Pilot Availability: 30/09/2025

General Availability: 14/10/2025

Predecessor: 2025.1.198

Release Purpose:

• New Features and Enhancements
• Generic Maintenance

Customer Action Required:

• N/A

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• sensor

New Features and Enhancements:

• Faster initial forwarding of telemetry 
• EPP scan and tamper events are included in new detections 
• New detections and detection improvements 

Generic Maintenance:

• Dependency updates and bug fixes

OS Support:

• AMD64
  • AlmaLinux 8.4 – 9.x
  • Amazon Linux 2
  • CentOS 7, 8
  • Debian 10, 11, 12
  • Oracle Linux 7, 8, 9 (RHCK and UEK)
  • RHEL 7, 8, 9
  • Rocky Linux 8, 9
  • SUSE Linux Enterprise Server 12 SP3 – SP5
  • SUSE Linux Enterprise Server 15
  • Ubuntu 18.04, 20.04, 22.04, 24.04
• ARMv8/AArch64
  • Debian 11, 12
  • Rocky 9
  • Ubuntu 22.04, 24.04

Please note that CentOS 6 and RHEL 6 are not supported. The Countercept Agent will break with this update, on endpoints where these operating systems are in use. WithSecure recommends upgrading these endpoints to the supported versions of the operating system, or switching clients to managed updates in collaboration with the WithSecure Engagement team.

The update is related to the Countercept Agent’s Ultralight Core component. Ultralight Core provides low-level functionality such as file hash calculation as part of the agent’s reporting of endpoint activity.

Product Name: Countercept Agent for Windows – Ultralight Core

Version: 2.1.20648

Pilot Availability: 23/09/2025

General Availability: 30/09/2025

Predecessor: 2.1.20571

Release Purpose:

• General maintenance

Customer Action Required:

• The Operating System should be Azure Code Signing (ACS) compliant to receive this update. See 
  
  https://community.withsecure.com/en/kb/articles/29714-changes-in-support-on-microsoft-windows-minimum-patch-level
  
  
               for more details.
  Any endpoints which are not ACS-compliant will continue to run the older version of the Ultralight Core (2.1.16183).

Name Changes:

No changes to file, process, or service names.

Files Updated:

• CapricornScanner.exe
• FsPisces.exe
• fsulgk.sys

New Features and Enhancements:

• N/A

General Maintenance:

• General maintenance of functionality not utilized by Countercept.

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

The update is related to the Countercept Agent’s Response Engine (RE) Common Response Actions Module (CRAM) components. The Response Engine and Common Response Actions Module components of the Countercept Agent enable the Detection and Response Team to retrieve artefacts for analysis or contain any identified threats within the environment. 

Product Name: Countercept Agent for Linux – CRAM and RE

Version:

• CRAM 1.24.112
• Response Engine 3.3.2

Pilot Availability: 22/09/2025

General Availability: 24/09/2025

Predecessor:

• CRAM 1.24.110
• Respone Engine 3.1

Release Purpose:

• Generic Maintenance

Customer Action Required

• N/A

Name Changes:

• Third-party libraries got newer versions with corresponding name changes.
• No changes to process, or service names.

Files Updated:

• Numerous files are updated with this release.

New Features and Enhancements:

• N/A

Generic Maintenance:

• Openssl and python components are updated to address recently discovered vulnerabilities.
• Bug fixes and performance improvements.

OS Support:

• AMD64
  • AlmaLinux 8.4 – 9.x
  • Amazon Linux 2
  • CentOS 7, 8
  • Debian 10, 11, 12
  • Oracle Linux 7, 8, 9 (RHCK and UEK)
  • RHEL 7, 8, 9
  • Rocky Linux 8, 9
  • SUSE Linux Enterprise Server 12 SP3 – SP5
  • SUSE Linux Enterprise Server 15 SP1 – SP3
  • Ubuntu 18.04, 20.04, 22.04, 24.04
• ARMv8/AArch64
  • Debian 11, 12
  • Rocky 9
  • Ubuntu 22.04, 24.04

Please note that CentOS 6 and RHEL 6 are not supported. The Countercept Agent might break with this update, on endpoints where these operating systems are in use. WithSecure recommends upgrading these endpoints to the supported operating system versions, or switching clients to managed updates in collaboration with the WithSecure Engagement team.

This is a notification that the minor update to our Windows agent’s Response Engine (RE) and Common Response Actions Module (CRAM) components, originally scheduled for General Availability on Monday, 8 September 2025, has been postponed to Monday, 15 September 2025. The update went to Pilot group endpoints on the 1st of September 2025 and contains general maintenance improvements for the Response Engine (RE) and Common Response Actions Module (CRAM) components.

Due to insufficient telemetry collected during the past week we were not able to confirm if all components function correctly. As a result, we have decided to keep this update in Pilot for a further week.

The update is related to the Countercept Agent’s Response Engine (RE) and Common Response Actions Module (CRAM) components. The Response Engine and Common Response Actions Module components of the Countercept Agent enable the Detection and Response Team to retrieve artefacts for analysis or contain any identified threats within the environment. 

Product Name: Countercept Agent for Windows – CRAM and RE

Version:

• CRAM 3.8.19
• Response Engine 3.1.33

Pilot Availability: 01/09/2025

General Availability: 08/09/2025

Predecessor:

• CRAM 3.8.19
• Response Engine 3.0.3-3-0-hotfix1

Release Purpose:

• General maintenance

Customer Action Required:

• N/A

Name Changes:

• No changes to file, process, or service names.

Files Updated:

• ffind.exe
• fls.exe
• fscram-response.exe
• icat.exe
• ifind.exe
• mmcat.exe
• mmls.exe
• mmstat.exe
• verify.exe
• winpmem_1.6.2.exe
• winpmem_2.1.post4.exe
• winpmem_mini_x64_rc2.exe

New Features and Enhancements:

• N/A

General Maintenance:

• Third-party component is updated to address recently discovered vulnerabilities, including CVE-2024-45491.
• Bug fixes and performance improvements.

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

The update is related to the Countercept Agent’s Sensor component. The Sensor component gathers data to be analyzed in the WithSecure backend to identify any malicious activity. 

Product Name: Countercept Agent for Windows – Sensor Component

Version: 2025.2.44

Pilot Availability: 13/08/2025

General Availability: 02/09/2025

Predecessor: 2025.1.89

Release Purpose:

• New Features and Enhancements
• Generic maintenance

Customer Action Required:

• The Operating System should be Azure Code Signing (ACS) compliant to receive this update. See 
  
  https://community.withsecure.com/en/kb/articles/29714-changes-in-support-on-microsoft-windows-minimum-patch-level
  
  
     for more details.
  Any endpoints which are not ACS-compliant will continue to run the previous production version of the sensor (2023.1.75).

Name Changes :

• No changes to file, process, or service names.

Files Updated :

• fsatp.sys
• fsatpl.exe
• fsatpn.exe
• install.exe
• sensor_control.exe

New Features and Enhancements:

• New detections and detection improvements

General Maintenance:

• Bug fixes and dependency updates

OS Support:

• Windows 10, 11
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

Please note that Windows 7 and Windows Server 2008 (R2) are not supported. On endpoints where these operating systems are in use, the Countercept agent will not be updated, and the previous sensor version (2024.2.31) will continue to run. New Countercept agent installations to these operating systems are now impossible.