60
55
55
35
60
57
60
Hackers Abuse VSSAdmin to Extract NTDS.dit and Delete Windows Recovery Copies
Huntress details intruders using PsExec and VSSAdmin on domain controllers to steal NTDS.dit credentials and delete shadow copies before ransomware.
Huntress analysts identified attackers launching SYSTEM-level command shells via PsExec on a domain controller, then running 'vssadmin create shadow' to snapshot and copy the NTDS.dit Active Directory database. Shadow copies were later deleted to destroy local recovery options ahead of a likely ransomware stage. Huntress recommends correlating VSS creation/deletion events with remote execution, DNS enumeration, and lateral movement rather than alerting on any single VSS event.
55
57
42
60
Patch Tuesday, December 2019 Edition
60
42
Microsoft Issues Patches for 3 Bugs Exploited as Zero
60
57
57
Microsoft addresses three Windows issues actively exploited
60
55
60
30
55
57
Microsoft May 2020 Patch Tuesday fixes 111 flaws, 13 Critical
60
60
57
47
Microsoft Fixes 80 Flaws — Including SMB PrivEsc and Azure CVSS 10.0 Bugs
60
Patch Tuesday for August 2022 fixed actively exploited zero
60
Microsoft Releases Emergency Windows 11 Update Following Patch Tuesday Bugs
Microsoft issued emergency Windows 11 update KB5129195 to fix Patch Tuesday regressions and fully close the CVE-2026-62721 privilege escalation flaw.
Microsoft shipped out-of-band cumulative update KB5129195 for Windows 11 24H2 and 25H2 (builds 26100.9457 and 26200.9457) after the September 8 Patch Tuesday rollup, which addressed over 960 CVEs including two actively exploited flaws, broke Remote Desktop Services, Hyper-V Plan9 folder sharing, and USB audio. The emergency release also strengthens the incomplete fix for CVE-2026-62721, an elevation-of-privilege flaw in the Windows User-Mode Power Service that could let a local attacker gain SYSTEM privileges. Companion patches cover Windows 11 26H1, Windows 10, and Windows Server. Some USB Audio Class 1.0 and AMD Radeon graphics issues remain unresolved.
70
60
60
60
57
47
60
Patch Tuesday, June 2025 Edition
60
57
Microsoft Patch Tuesday for January 2026 — Snort rules and prominent vulnerabilities
60
42
57