Iran-linked hackers increasingly spy on governments in Gulf region, researchers say

CVE-2024-30088 is a time-of-check to time-of-use (TOCTOU) race condition in the Microsoft Windows kernel (CWE-367) that allows a local, low-privileged attacker to elevate to SYSTEM-level privileges. Because it is a timing race with high attack complexity, exploitation requires locally executing crafted code that repeatedly races the kernel's validation of a resource, but no user interaction is needed and the attacker only needs the ability to already run code on the target. Successful exploitation grants full control of the local machine (high confidentiality, integrity, and availability impact), which attackers typically chain after initial access or another flaw to gain complete host compromise. Virtually all supported Windows 10 and Windows 11 client releases and Windows Server 2016 through 2022 23H2 are affected if unpatched. The flaw is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-10-15 with known ransomware use, Iran-linked OilRig used it in an espionage campaign targeting UAE and Gulf governments, and EPSS assigns a ~68% probability of exploitation within 30 days (99th percentile).

Do: Apply the Windows cumulative security update for CVE-2024-30088 from Microsoft's advisory on every affected Windows 10, Windows 11, and Windows Server release (the fix shipped in Microsoft's June 2024 monthly security updates; confirm your build number against the advisory). Prioritize multi-user hosts, RDP/jump servers, and endpoints where untrusted users or code run, since this is a local privilege escalation used post-compromise — check endpoint logs for suspicious local process activity coinciding with privilege changes. Consistent with the CISA KEV required action (added 2024-10-15), patch promptly per vendor instructions or discontinue use of affected builds if patching is not possible.