Millions of devices could be hacked exploiting flaws targeted by tools stolen from FireEye

Microsoft Windows Active Directory's Group Policy Preferences stores passwords deployed by administrators (for local accounts, services, and scheduled tasks) in XML files under SYSVOL, encrypted with a single, publicly documented AES key shared by every domain. Any authenticated domain user can read those SYSVOL preference files and decrypt the stored 'cpassword' values, recovering credentials for privileged accounts. With those credentials, an attacker can elevate privileges on the domain and move laterally, as observed in ransomware campaigns. The flaw affects Microsoft Windows environments in which Group Policy Preferences was ever used to distribute passwords, and previously issued passwords remain recoverable even after systems are patched unless rotated. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use, and EPSS estimates a 65.1% probability of exploitation within 30 days (99th percentile).

Do: Apply the vendor updates per CISA's required action (Microsoft bulletin MS14-025) on domain controllers and all Windows clients. Audit SYSVOL for preference XML files containing 'cpassword' (Groups.xml, Services.xml, ScheduledTasks.xml, DataSources.xml, etc.) and rotate every password that was ever distributed via Group Policy Preferences, since prior credentials remain decryptable with the public key even after patching. Going forward, avoid GPP-stored passwords and use alternatives such as Microsoft LAPS for local administrator credentials.

CVE-2016-0167 is an elevation-of-privilege flaw in the Windows kernel-mode Win32k driver affecting Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 1507 and 1511, and Windows Server 2008, 2008 R2, 2012 and 2012 R2. A local attacker must get a user to run a crafted application (the CVSS vector requires user interaction), which then abuses the Win32k bug to break out of user context into the kernel. Successful exploitation grants full local privileges with high impact on confidentiality, integrity and availability, and is commonly chained with other malware or ransomware for complete system compromise. Any unpatched machine on those operating system versions is affected; the April 2016 Microsoft security updates (MS16-034) and all later cumulative updates fix it, so residual exposure is concentrated in legacy estates that never applied the patch. Exploitation is confirmed in the wild: CISA added the CVE to the KEV catalog on 2021-11-03 with known ransomware use (EPSS 5.7% 30-day probability, 93rd percentile), and related coverage of the FireEye tool-theft disclosures warned that millions of unpatched devices could be hacked using exploits targeting this flaw class.

Do: Apply the April 2016 Microsoft security updates (MS16-034) or any later cumulative/monthly rollup to every affected Windows Vista, 7, 8.1, RT 8.1, 10 (1507/1511), Server 2008/2008 R2 and 2012/2012 R2 system, and verify the Win32k kernel driver is at the patched level. Since these operating systems are past end of support, prioritize migration to supported Windows versions or enroll legacy servers in extended security updates. Because this is a KEV entry with known ransomware use, treat any unpatched legacy host as at risk and hunt for local privilege-escalation activity chained with malware or ransomware.

CVE-2017-11774 is a security feature bypass in Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and 2013 RT SP1, and Outlook 2016, caused by the way Outlook handles objects in memory, allowing an attacker to execute arbitrary commands. Triggering the flaw requires user interaction on a local system: public research by SensePost (the referenced PoC) showed a specially crafted email can set a mail folder's home page so that attacker-chosen content loads without a security prompt when the user views the folder. A successful attacker gains code execution in the context of the logged-in user, providing a foothold for credential theft or follow-on activity on the workstation. Any organization still running the affected Outlook editions — typically corporate users on Exchange — is exposed, though these are older editions that many organizations have since migrated away from. The flaw is exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03, and the related headlines show US Cyber Command warning that Iran-linked actors were exploiting this CVE alongside other flaws using tools stolen from FireEye, with EPSS putting 30-day exploitation probability at roughly 60% (99th percentile).

Do: Apply Microsoft's security updates (released with the October 2017 Patch Tuesday or later) for Outlook 2010 SP2, 2013 SP1/2013 RT SP1, and 2016, as required by CISA's KEV listing. Because Outlook 2010 and 2013 are past mainstream support, organizations still running them should upgrade to a supported Outlook release. Defenders should also hunt for exploitation using the indicators US Cyber Command shared with its warning about Iran-linked activity, and check whether user mail folders have had home pages set by untrusted mail.

CVE-2018-8581 is a privilege escalation vulnerability in Microsoft Exchange Server that, when successfully exploited, allows an attacker to impersonate any other user of the Exchange server. Impersonating an arbitrary user lets the attacker act as that user — reading their mailbox, sending messages as them, and, if the impersonated account is privileged or administrative, gaining elevated access to the messaging environment. Organizations running on-premises Microsoft Exchange Server are affected; the provided data does not specify the affected version ranges, so operators should consult Microsoft's CVE-2018-8581 advisory for the exact builds covered. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2022-03-03 with known ransomware use, confirming in-the-wild exploitation, and EPSS assigns a 27.4% probability of exploitation in the next 30 days (98th percentile). No public proof-of-concept is known, but the KEV listing and ransomware linkage make patching exposed Exchange servers urgent.

Do: Apply Microsoft's Exchange security updates per vendor instructions, as required by the CISA KEV listing, and confirm the patched build for your Exchange version in Microsoft's CVE-2018-8581 advisory since affected version ranges are not enumerated in this data. Because ransomware operators are known to exploit this flaw, prioritize internet-facing Exchange servers and hunt for signs of compromise — unexpected user impersonation, anomalous mailbox access, and post-exploitation activity — before and after patching.

Microsoft SharePoint fails to check the source markup of an application package, an improper input validation flaw (CWE-20) that allows maliciously crafted markup to be processed by the server. An attacker triggers the flaw by getting an affected SharePoint server to handle a crafted application package, without any special privileges described in the disclosure. Successful exploitation lets the attacker run remote code in the context of the SharePoint application pool and the SharePoint server farm account, providing control of the web server and access to a highly privileged farm-level identity. Any organization running an affected on-premises Microsoft SharePoint deployment is exposed, with internet-facing SharePoint servers at greatest risk. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use and EPSS puts the probability of exploitation at 99.9%, although no public proof-of-concept is catalogued.

Do: Apply Microsoft's SharePoint security updates per vendor instructions immediately, prioritizing internet-exposed SharePoint servers as CISA's required action directs. Given known in-the-wild and ransomware use, hunt for signs of compromise such as unexpected .aspx or webshell files in SharePoint directories and anomalous use of the SharePoint farm account. Restrict or firewall internet exposure of SharePoint servers until patches are confirmed applied.

CVE-2019-0708 is a use-after-free (CWE-416) vulnerability in Microsoft Remote Desktop Services, formerly Terminal Services, in which an unauthenticated attacker can connect to a target system over RDP and send specially crafted requests to trigger the flaw. Because the trigger requires no authentication, the flaw is wormable: a successful exploit grants remote code execution on the target host, potentially with elevated privileges, and could allow self-propagating attacks similar to WannaCry. Organizations running the affected Microsoft Remote Desktop Services, particularly legacy Windows releases still accepting inbound RDP connections, are in scope. Exploitation is confirmed in the wild: the flaw (nicknamed BlueKeep) is listed in CISA's KEV catalog (added 2021-11-03), CISA notes known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days.

Do: Apply Microsoft's security updates for CVE-2019-0708 per vendor instructions, prioritizing legacy or end-of-support Windows systems exposed to inbound RDP. As mitigation, restrict RDP (TCP 3389) to trusted networks or VPN access, require Network Level Authentication (NLA), and audit perimeter firewalls and public scans for open RDP listeners. The vulnerability is in the CISA KEV catalog, so patching is treated as a required action for federal and high-risk environments.

CVE-2020-0688 is a remote code execution vulnerability in Microsoft Exchange Server caused by the validation key not being uniquely created at install time, leaving deployments with a predictable, shared key (CWE-287, improper authentication). A remote attacker who can reach an affected Exchange server and knows the common install-time key can supply maliciously crafted, cryptographically signed payloads that the server trusts, triggering code execution without needing per-server secrets. Successful exploitation gives the attacker code execution on the Exchange server, which can be used to access mail data, move laterally, and stage follow-on activity; CISA notes known use in ransomware campaigns. All organizations running the affected on-premises Microsoft Exchange Server are in scope per CISA's listing, though the affected version range is not specified in the source data. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2021-11-03 with known ransomware use, and EPSS rates 30-day exploitation probability at 100% (top percentile).

Do: Apply Microsoft's Exchange security updates addressing CVE-2020-0688 (released in February 2020) to every on-premises Exchange server, per CISA's required action. As an interim mitigation, configure a unique ASP.NET machineKey in each Exchange server's web.config instead of the default shared install-time key, and hunt for indicators of exploitation given the known ransomware use.

CVE-2020-1472, widely known as "Zerologon," is an elevation-of-privilege flaw in how the Netlogon secure channel is established over the Netlogon Remote Protocol (MS-NRPC) on Microsoft domain controllers. An unauthenticated attacker with network reachability to a domain controller sends specially crafted Netlogon messages to establish a vulnerable secure channel and then runs a specially crafted application on the network to obtain domain administrator access. Successful exploitation yields domain administrator privileges, effectively full compromise of the Active Directory environment, and the flaw is known to be used in ransomware operations. Any organization running affected Windows Server versions (2008 through 20H2) as domain controllers is exposed, along with environments using Netlogon implementations from Samba and distributions or products from Fedora, openSUSE, Canonical (Ubuntu), Debian, Synology, and Oracle. Exploitation is highly active: a public Zerologon PoC/exploit is available, the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03, with known ransomware use), and EPSS estimates a 99.4% probability of exploitation within 30 days.

Do: Apply the vendor updates on all domain controllers and other affected systems immediately, following Microsoft's two-phase Netlogon secure channel guidance (the enforcement phase of the phased rollout began in Q1 2021). Audit Netlogon secure-channel connections and event logs for clients still using vulnerable connections before enabling full enforcement, and install updated packages for Samba and other Netlogon implementations from Fedora, openSUSE, Ubuntu, Debian, Synology, and Oracle. Given known ransomware use, prioritize patching any domain controller reachable from user networks, VPNs, or the internet.