CVE-2022-24521
published 2022-04-15CVE-2022-24521: Windows Common Log File System Driver Elevation of Privilege Vulnerability
PriorityP186high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
KEVITWEXPLOITRansomware
CISA Known Exploited Vulnerabilitydue 2022-05-04
Exploited in the wild
EPSS
7.30%
93.7th percentile
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Affected
51 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_1507 | < 10.0.10240.19265 | 10.0.10240.19265 |
| microsoft | windows_10_1607 | < 10.0.14393.5066 | 10.0.14393.5066 |
| microsoft | windows_10_1809 | <= 10.0.17763.2803 | — |
| microsoft | windows_10_1909 | < 10.0.18363.2212 | 10.0.18363.2212 |
| microsoft | windows_10_20h2 | < 10.0.19042.1645 | 10.0.19042.1645 |
| microsoft | windows_10_21h1 | < 10.0.19043.1645 | 10.0.19043.1645 |
| microsoft | windows_10_21h2 | < 10.0.19044.1645 | 10.0.19044.1645 |
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < 10.0.10240.19265 | 10.0.10240.19265 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.5066 | 10.0.14393.5066 |
| microsoft | windows_10_version_1809 | >= 10.0.0 < 10.0.17763.2803 | 10.0.17763.2803 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.2803 | 10.0.17763.2803 |
| microsoft | windows_10_version_1909 | >= 10.0.0 < 10.0.18363.2212 | 10.0.18363.2212 |
| microsoft | windows_10_version_20h2 | >= 10.0.0 < 10.0.19042.1645 | 10.0.19042.1645 |
| microsoft | windows_10_version_21h1 | >= 10.0.0 < 10.0.19043.1645 | 10.0.19043.1645 |
| microsoft | windows_10_version_21h2 | >= 10.0.19043.0 < 10.0.19044.1645 | 10.0.19044.1645 |
| microsoft | windows_11_21h2 | < 10.0.22000.613 | 10.0.22000.613 |
| microsoft | windows_11_version_21h2 | >= 10.0.0 < 10.0.22000.613 | 10.0.22000.613 |
| microsoft | windows_7 | >= 6.1.0 < 6.1.7601.25924 | 6.1.7601.25924 |
| microsoft | windows_7_service_pack_1 | >= 6.1.0 < 6.1.7601.25924 | 6.1.7601.25924 |
| microsoft | windows_8.1 | >= 6.3.0 < 6.3.9600.20337 | 6.3.9600.20337 |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.7601.0 < 6.1.7601.25924 | 6.1.7601.25924 |
| microsoft | windows_server_2008_service_pack_2 | >= 6.0.6003.0 < 6.0.6003.21446 | 6.0.6003.21446 |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012 | >= 6.2.9200.0 < 6.2.9200.23679 | 6.2.9200.23679 |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect exploit BLF file manipulation: monitor for CreateLogFile API calls immediately followed by direct binary patching of the resulting .blf file (five specific field modifications including CLFS_BASE_RECORD_HEADER->rgClients[0] override) before AddLogContainer is called. ↗
- →Detect PreviousMode manipulation: alert on kernel KTHREAD.PreviousMode field being decremented from 1 to 0 for a user-mode thread, enabling subsequent NtReadVirtualMemory/NtWriteVirtualMemory calls to access kernel memory. ↗
- →Detect kernel address space enumeration via NtQuerySystemInformation with class 0x40 (SystemExtendedHandleInformation) from Medium IL processes, which is used by the exploit to locate KTHREAD, process tokens, and ClfsSetEndOfLog addresses. ↗
- →Detect CLFS exploit pattern: monitor for a user-mode process allocating memory specifically at virtual address 0x40000000 followed by triggering CLFS operations, as the exploit places its controlled kernel callback data at this fixed address. ↗
- →Detect CLFS exploit overlap technique: monitor for CLFS_CLIENT_CONTEXT and CLFS_CONTAINER_CONTEXT structures overlapping in a BLF file, specifically where cbSymbolZone points into the middle of an existing CLFS_CLIENT_CONTEXT structure. ↗
- →Detect post-exploitation SAM dumping: alert on processes with newly elevated SYSTEM privileges accessing HKEY_LOCAL_MACHINE\SAM registry hive, consistent with post-CLFS-EoP credential harvesting behavior. ↗
- →Detect Cuba ransomware / Tropical Scorpius: look for unsigned dropper loading a signed kernel driver (ApcHelper.sys) signed with the LAPSUS NVIDIA-leaked certificate, targeting security product processes for termination. ↗
- →Detect Cuba ransomware file encryption marker: scan for files prepended with the magic bytes/string 'FIDEL.CA' (8 bytes) followed by an RSA-4096 encrypted block, and files with the '.cuba' extension appended. ↗
- →Detect shared debug strings across CLFS exploit family: the presence of identical debug message strings across multiple exploit samples is a strong indicator of common authorship; hunt for these strings in memory or on disk across CLFS-related exploit artifacts. ↗
- ·The exploit targets Medium Integrity Level (Medium IL) processes; it will NOT work from Low IL contexts. Detection logic based on NtQuerySystemInformation class 0x40 should be scoped to Medium IL and above to avoid false negatives. ↗
- ·The PreviousMode technique used by this exploit is blocked in new builds of Windows 11 but remains viable on Windows 10 and Windows Server. Detection and patching priority should be higher for Windows 10 and Server environments. ↗
- ·The CVE-2022-24521 exploit was originally developed as a 1-day exploit after the April 2022 patch release; defenders should expect rapid weaponization of CLFS patches by the same threat actor group, as this pattern repeated across all five exploits in the series. ↗
- ·CLFS exception handlers in clfs.sys mask access violations triggered during exploitation (try/catch blocks suppress crashes), meaning crash-based detection or fuzzing will miss exploitation attempts; behavioral detection is required. ↗
- ·The exploit for CVE-2022-24521 uses the ObDereferenceObject function to decrement an arbitrary QWORD in kernel memory via a controlled address (0x40000000); the primitive is a decrement, not a direct write — detection rules should account for this indirect corruption pattern. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
cisa7.8HIGH
vendor_msrc7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Microsoft Windows CLFS Driver Privilege Escalation Vulnerability
cisa·2022-04-13·CVSS 7.8
CVE-2022-24521 [HIGH] CWE-787 Microsoft Windows CLFS Driver Privilege Escalation Vulnerability
Vulnerability: Microsoft Windows CLFS Driver Privilege Escalation Vulnerability
Affected: Microsoft Windows
Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2022-24521
Remediation Due Date: 2022-05-04
Microsoft
Windows Common Log File System Driver Elevation of Privilege Vulnerability
vendor_msrc·2022-04-12·CVSS 7.8
CVE-2022-24521 [HIGH] Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver: Windows Common Log File System Driver
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Elevation of Privilege
Exploit Status: Publicly Disclosed:No;Exploited:Yes;Latest Software Release:Exploitation Detected;Older Software Release:Exploitation Detected
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5012647
Reference: https://support.microsoft.com/help/5012647
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5012591
Reference: https://support.microsoft.com/help/5012591
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5012599
Reference: https://support.microsoft.com/help/5012599
Reference
GHSA
GHSA-fcmw-94mj-87r8: Windows Common Log File System Driver Elevation of Privilege Vulnerability
ghsa_unreviewed·2022-04-16·CVSS 7.8
CVE-2022-24481 [HIGH] CWE-269 GHSA-fcmw-94mj-87r8: Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24521.
GHSA
GHSA-59qr-cc8f-v837: Windows Common Log File System Driver Elevation of Privilege Vulnerability
ghsa_unreviewed·2022-04-16·CVSS 7.8
CVE-2022-24521 [HIGH] CWE-787 GHSA-59qr-cc8f-v837: Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-24481.
VulnCheck
Microsoft Windows CLFS Driver Privilege Escalation Vulnerability
vulncheck·2022·CVSS 7.8
CVE-2022-24521 [HIGH] CWE-787 Microsoft Windows CLFS Driver Privilege Escalation Vulnerability
Microsoft Windows CLFS Driver Privilege Escalation Vulnerability
Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation.
Affected: Microsoft Windows
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2022-Apr; https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.covertswarm.com/post/multiple-windows-zero-days-cve-2022-24521-cve-2022-26904-and-cve-2022-26809; https://unit42.paloaltonetworks.com/cuba-ransomware-tropical-scorpius/; https://www.bleepingcomputer.com/news/se
VulnCheck
Remote Procedure Call Runtime Remote Code Execution
vulncheck·2022·CVSS 9.8
CVE-2022-26809 [CRITICAL] Remote Procedure Call Runtime Remote Code Execution
Remote Procedure Call Runtime Remote Code Execution
Remote Procedure Call Runtime Remote Code Execution Vulnerability
Affected: Microsoft Windows
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Known Ransomware Campaign Use: Known
Exploitation References: https://www.covertswarm.com/post/multiple-windows-zero-days-cve-2022-24521-cve-2022-26904-and-cve-2022-26809; https://www.group-ib.com/resources/research-hub/hi-tech-crime-trends-2022/
Exploit PoC: https://vulncheck.com/xdb/bc623cfe5572
VulnCheck
Microsoft Windows User Profile Service Privilege Escalation Vulnerability
vulncheck·2022·CVSS 7.0
CVE-2022-26904 [HIGH] CWE-362 Microsoft Windows User Profile Service Privilege Escalation Vulnerability
Microsoft Windows User Profile Service Privilege Escalation Vulnerability
Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.
Affected: Microsoft Windows
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.covertswarm.com/post/multiple-windows-zero-days-cve-2022-24521-cve-2022-26904-and-cve-2022-26809; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Remediation Due: 2022-05-16
Project0
Project Zero RCA: CVE-2022-24521: Windows Common Log File System (CLFS) Logical-Error Vulnerability
project_zero·CVSS 7.8
CVE-2022-24521 [HIGH] Project Zero RCA: CVE-2022-24521: Windows Common Log File System (CLFS) Logical-Error Vulnerability
# CVE-2022-24521: Windows Common Log File System (CLFS) Logical-Error Vulnerability
Sergey Kornienko (@b1thvn_) of PixiePoint Security
## The Basics
**Disclosure or Patch Date:** April 12, 2022
**Product:** Microsoft Windows
**Advisory:** https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24521
**Affected Versions:** Before security updates of April 12, 2022, for Windows 7, 8.1, 10, 11 and Windows Server 2008, 2012, 2016, 2019, 2022
**First Patched Version:** Security updates of April 12, 2022, for CVE-2022-24521
**Issue/Bug Report:** N/A
**Patch CL:** N/A
**Bug-Introducing CL:** N/A
**Reporter(s):** National Security Agency, Adam Podlosky and Amir Bazine of Crowdstrike
## The Code
**Proof-of-concept:** N/A
**Exploit sample:** N/A
**Did you have access to the expl
No detection rules found.
No public exploits indexed.
Elastic
In-the-Wild Windows LPE 0-days: Insights & Detection Strategies — Elastic Security Labs
blogs_elastic·2024-03-29
In-the-Wild Windows LPE 0-days: Insights & Detection Strategies — Elastic Security Labs
29 March 2024•Samir Bousseaden
# In-the-Wild Windows LPE 0-days: Insights & Detection Strategies
This article will evaluate detection methods for Windows local privilege escalation techniques based on dynamic behaviors analysis using Elastic Defend features.
7 min readDetection Engineering, Enablement
Based on disclosures from Microsoft, Google, Kaspersky, Checkpoint, and other industry players, it has become apparent that in-the-wild Windows local privilege escalation (LPE) zero-days are increasingly prevalent and essential components in sophisticated cybercrime and APT arsenals. It is important for detection engineers to closely examine these publicly accessible samples and assess possible avenues for detection.
This article will not delve into the root cause or specific details of
Securelist
Windows CLFS and five exploits used by ransomware operators (Exploit #1 – CVE-2022-24521)
blogs_securelist·2023-12-21·CVSS 7.8
[HIGH] Windows CLFS and five exploits used by ransomware operators (Exploit #1 – CVE-2022-24521)
Authors
Boris Larin
This is the second part of our study about the Common Log File System (CLFS) and five vulnerabilities in this Windows OS component that have been used in ransomware attacks throughout the year. Please read the previous part first if you haven’t already.
You can skip to the other parts using this table of contents or using the link at the end of this part.
Part 1 – Windows CLFS and five exploits of ransomware operators
Part 2 – Windows CLFS and five exploits of ransomware operators (Exploit #1 – CVE-2022-24521)
Part 3 – Windows CLFS and five exploits of ransomware operators (Exploit #2 – September 2022)
Part 4 – Windows CLFS and five exploits of ransomware operators (Exploit #3 – October 2022)
Part 5 – Windows CLFS and five exploits of ransomware operators (Explo
Securelist
Windows CLFS and five exploits used by ransomware operators (Exploit #3 – October 2022)
blogs_securelist·2023-12-21·CVSS 7.8
[HIGH] Windows CLFS and five exploits used by ransomware operators (Exploit #3 – October 2022)
Authors
- Boris Larin
This is part four of our study about the Common Log File System (CLFS) and five vulnerabilities in this Windows OS component that have been used in ransomware attacks throughout the year. Please read the previous parts first if you haven’t already.
You can skip to the other parts using this table of contents or using the link at the end of this part.
- Part 1 – Windows CLFS and five exploits of ransomware operators
- Part 2 – Windows CLFS and five exploits of ransomware operators (Exploit #1 – CVE-2022-24521)
- Part 3 – Windows CLFS and five exploits of ransomware operators (Exploit #2 – September 2022)
- Part 4 – Windows CLFS and five exploits of ransomware operators (Exploit #3 – October 2022)
- Part 5 – Windows CLFS and five exploits of ransomware operators (Ex
Securelist
Windows CLFS and five exploits used by ransomware operators (Exploit #4 – CVE-2023-23376)
blogs_securelist·2023-12-21·CVSS 7.8
[HIGH] Windows CLFS and five exploits used by ransomware operators (Exploit #4 – CVE-2023-23376)
Authors
Boris Larin
This is part five of our study about the Common Log File System (CLFS) and five vulnerabilities in this Windows OS component that have been used in ransomware attacks throughout the year. Please read the previous parts first if you haven’t already.
You can skip to the other parts using this table of contents or using the link at the end of this part.
Part 1 – Windows CLFS and five exploits of ransomware operators
Part 2 – Windows CLFS and five exploits of ransomware operators (Exploit #1 – CVE-2022-24521)
Part 3 – Windows CLFS and five exploits of ransomware operators (Exploit #2 – September 2022)
Part 4 – Windows CLFS and five exploits of ransomware operators (Exploit #3 – October 2022)
Part 5 – Windows CLFS and five exploits of ransomware operators (Exploit #4
Securelist
Windows CLFS and five exploits used by ransomware operators (Exploit #2 – September 2022)
blogs_securelist·2023-12-21·CVSS 7.8
[HIGH] Windows CLFS and five exploits used by ransomware operators (Exploit #2 – September 2022)
Authors
Boris Larin
This is the third part of our study about the Common Log File System (CLFS) and five vulnerabilities in this Windows OS component that have been used in ransomware attacks throughout the year. Please read the previous parts first if you haven’t already.
You can skip to the other parts using this table of contents or using the link at the end of this part.
Part 1 – Windows CLFS and five exploits of ransomware operators
Part 2 – Windows CLFS and five exploits of ransomware operators (Exploit #1 – CVE-2022-24521)
Part 3 – Windows CLFS and five exploits of ransomware operators (Exploit #2 – September 2022)
Part 4 – Windows CLFS and five exploits of ransomware operators (Exploit #3 – October 2022)
Part 5 – Windows CLFS and five exploits of ransomware operators (Explo
Securelist
Windows CLFS and five exploits used by ransomware operators (Exploit #4 – CVE-2023-23376)
blogs_securelist·2023-12-21·CVSS 7.8
CVE-2023-23376 [HIGH] Windows CLFS and five exploits used by ransomware operators (Exploit #4 – CVE-2023-23376)
Authors
- Boris Larin
This is part five of our study about the Common Log File System (CLFS) and five vulnerabilities in this Windows OS component that have been used in ransomware attacks throughout the year. Please read the previous parts first if you haven’t already.
You can skip to the other parts using this table of contents or using the link at the end of this part.
- Part 1 – Windows CLFS and five exploits of ransomware operators
- Part 2 – Windows CLFS and five exploits of ransomware operators (Exploit #1 – CVE-2022-24521)
- Part 3 – Windows CLFS and five exploits of ransomware operators (Exploit #2 – September 2022)
- Part 4 – Windows CLFS and five exploits of ransomware operators (Exploit #3 – October 2022)
- Part 5 – Windows CLFS and five exploits of ransomware operators (Ex
Securelist
Windows CLFS and five exploits used by ransomware operators (Exploit #2 – September 2022)
blogs_securelist·2023-12-21·CVSS 7.8
[HIGH] Windows CLFS and five exploits used by ransomware operators (Exploit #2 – September 2022)
Authors
- Boris Larin
This is the third part of our study about the Common Log File System (CLFS) and five vulnerabilities in this Windows OS component that have been used in ransomware attacks throughout the year. Please read the previous parts first if you haven’t already.
You can skip to the other parts using this table of contents or using the link at the end of this part.
- Part 1 – Windows CLFS and five exploits of ransomware operators
- Part 2 – Windows CLFS and five exploits of ransomware operators (Exploit #1 – CVE-2022-24521)
- Part 3 – Windows CLFS and five exploits of ransomware operators (Exploit #2 – September 2022)
- Part 4 – Windows CLFS and five exploits of ransomware operators (Exploit #3 – October 2022)
- Part 5 – Windows CLFS and five exploits of ransomware operator
Securelist
Windows CLFS and five exploits used by ransomware operators
blogs_securelist·2023-12-21·CVSS 7.8
CVE-2023-28252 [HIGH] Windows CLFS and five exploits used by ransomware operators
Authors
- Boris Larin
In April 2023, we published a blog post about a zero-day exploit we discovered in ransomware attacks that was patched as CVE-2023-28252 after we promptly reported it to Microsoft.
In that blog post, we mentioned that the zero-day exploit we discovered was very similar to other Microsoft Windows elevation-of-privilege (EoP) exploits that we have seen in ransomware attacks throughout the year. We found that since June 2022, attackers have used exploits for at least five different Common Log File System (CLFS) driver vulnerabilities. Four of these vulnerabilities used by the attackers (CVE-2022-24521, CVE-2022-37969, CVE-2023-23376, CVE-2023-28252) have been captured in the wild as zero-days.
Seeing a Win32k driver zero-day being used in attacks isn’t really surprisi
Securelist
Windows CLFS and five exploits used by ransomware operators (Exploit #3 – October 2022)
blogs_securelist·2023-12-21·CVSS 7.8
[HIGH] Windows CLFS and five exploits used by ransomware operators (Exploit #3 – October 2022)
Authors
Boris Larin
This is part four of our study about the Common Log File System (CLFS) and five vulnerabilities in this Windows OS component that have been used in ransomware attacks throughout the year. Please read the previous parts first if you haven’t already.
You can skip to the other parts using this table of contents or using the link at the end of this part.
Part 1 – Windows CLFS and five exploits of ransomware operators
Part 2 – Windows CLFS and five exploits of ransomware operators (Exploit #1 – CVE-2022-24521)
Part 3 – Windows CLFS and five exploits of ransomware operators (Exploit #2 – September 2022)
Part 4 – Windows CLFS and five exploits of ransomware operators (Exploit #3 – October 2022)
Part 5 – Windows CLFS and five exploits of ransomware operators (Exploit #4
Securelist
Windows CLFS and five exploits used by ransomware operators
blogs_securelist·2023-12-21·CVSS 7.8
CVE-2023-28252 [HIGH] Windows CLFS and five exploits used by ransomware operators
Authors
Boris Larin
In April 2023, we published a blog post about a zero-day exploit we discovered in ransomware attacks that was patched as CVE-2023-28252 after we promptly reported it to Microsoft.
In that blog post, we mentioned that the zero-day exploit we discovered was very similar to other Microsoft Windows elevation-of-privilege (EoP) exploits that we have seen in ransomware attacks throughout the year. We found that since June 2022, attackers have used exploits for at least five different Common Log File System (CLFS) driver vulnerabilities. Four of these vulnerabilities used by the attackers ( CVE-2022-24521 , CVE-2022-37969 , CVE-2023-23376 , CVE-2023-28252 ) have been captured in the wild as zero-days.
Seeing a Win32k driver zero-day being used in attacks isn’t really surpr
Securelist
Windows CLFS and five exploits used by ransomware operators (Exploit #1 – CVE-2022-24521)
blogs_securelist·2023-12-21·CVSS 7.8
CVE-2022-24521 [HIGH] Windows CLFS and five exploits used by ransomware operators (Exploit #1 – CVE-2022-24521)
Authors
- Boris Larin
This is the second part of our study about the Common Log File System (CLFS) and five vulnerabilities in this Windows OS component that have been used in ransomware attacks throughout the year. Please read the previous part first if you haven’t already.
You can skip to the other parts using this table of contents or using the link at the end of this part.
- Part 1 – Windows CLFS and five exploits of ransomware operators
- Part 2 – Windows CLFS and five exploits of ransomware operators (Exploit #1 – CVE-2022-24521)
- Part 3 – Windows CLFS and five exploits of ransomware operators (Exploit #2 – September 2022)
- Part 4 – Windows CLFS and five exploits of ransomware operators (Exploit #3 – October 2022)
- Part 5 – Windows CLFS and five exploits of ransomware operator
Securelist
Windows CLFS and five exploits used by ransomware operators (Exploit #5 – CVE-2023-28252)
blogs_securelist·2023-12-21·CVSS 7.8
CVE-2022-24521 [HIGH] Windows CLFS and five exploits used by ransomware operators (Exploit #5 – CVE-2023-28252)
Authors
Boris Larin
This is part six of our study about the Common Log File System (CLFS) and five vulnerabilities in this Windows OS component that have been used in ransomware attacks throughout the year. Please read the previous parts first if you haven’t already.
You can go to other parts using this table of contents:
Part 1 – Windows CLFS and five exploits of ransomware operators
Part 2 – Windows CLFS and five exploits of ransomware operators (Exploit #1 – CVE-2022-24521)
Part 3 – Windows CLFS and five exploits of ransomware operators (Exploit #2 – September 2022)
Part 4 – Windows CLFS and five exploits of ransomware operators (Exploit #3 – October 2022)
Part 5 – Windows CLFS and five exploits of ransomware operators (Exploit #4 – CVE-2023-23376)
Part 6 – Windows CLFS and fiv
Securelist
Windows CLFS and five exploits used by ransomware operators (Exploit #5 – CVE-2023-28252)
blogs_securelist·2023-12-21·CVSS 7.8
CVE-2023-28252 [HIGH] Windows CLFS and five exploits used by ransomware operators (Exploit #5 – CVE-2023-28252)
Authors
- Boris Larin
This is part six of our study about the Common Log File System (CLFS) and five vulnerabilities in this Windows OS component that have been used in ransomware attacks throughout the year. Please read the previous parts first if you haven’t already.
You can go to other parts using this table of contents:
- Part 1 – Windows CLFS and five exploits of ransomware operators
- Part 2 – Windows CLFS and five exploits of ransomware operators (Exploit #1 – CVE-2022-24521)
- Part 3 – Windows CLFS and five exploits of ransomware operators (Exploit #2 – September 2022)
- Part 4 – Windows CLFS and five exploits of ransomware operators (Exploit #3 – October 2022)
- Part 5 – Windows CLFS and five exploits of ransomware operators (Exploit #4 – CVE-2023-23376)
- Part 6 – Windows CLF
Securelist
Nokoyawa ransomware attacks with Windows zero-day
blogs_securelist·2023-04-11·CVSS 7.8
[HIGH] Nokoyawa ransomware attacks with Windows zero-day
Table of Contents
- Elevation-of-privilege exploit
- Post exploitation and malware
- Conclusions
- Indicators of compromise
Authors
- Boris Larin
Updated April 20, 2023
In February 2023, Kaspersky technologies detected a number of attempts to execute similar elevation-of-privilege exploits on Microsoft Windows servers belonging to small and medium-sized businesses in the Middle East, in North America, and previously in Asia regions. These exploits were very similar to already known Common Log File System (CLFS) driver exploits that we analyzed previously, but we decided to double check and it was worth it – one of the exploits turned out to be a zero-day, supporting different versions and builds of Windows, including Windows 11. The exploit was highly obfuscated with more than 80% of
Tenable
Microsoft’s April 2023 Patch Tuesday Addresses 97 CVEs (CVE-2023-28252)
blogs_tenable·2023-04-11·CVSS 7.8
[HIGH] Microsoft’s April 2023 Patch Tuesday Addresses 97 CVEs (CVE-2023-28252)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Securelist
Nokoyawa ransomware attacks with Windows zero-day
blogs_securelist·2023-04-11·CVSS 7.8
[HIGH] Nokoyawa ransomware attacks with Windows zero-day
Table of Contents
Elevation-of-privilege exploit
Post exploitation and malware
Conclusions
Indicators of compromise
Authors
Boris Larin
Updated April 20, 2023
In February 2023, Kaspersky technologies detected a number of attempts to execute similar elevation-of-privilege exploits on Microsoft Windows servers belonging to small and medium-sized businesses in the Middle East, in North America, and previously in Asia regions. These exploits were very similar to already known Common Log File System (CLFS) driver exploits that we analyzed previously, but we decided to double check and it was worth it – one of the exploits turned out to be a zero-day, supporting different versions and builds of Windows, including Windows 11. The exploit was highly obfuscated with more than 80% of the its
Tenable
Microsoft’s February 2023 Patch Tuesday Addresses 75 CVEs (CVE-2023-23376)
blogs_tenable·2023-02-14·CVSS 7.8
[HIGH] Microsoft’s February 2023 Patch Tuesday Addresses 75 CVEs (CVE-2023-23376)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Zscaler
CVE-2022-37969 | Windows CLFS Zero-Day - Zscaler Blog
blogs_zscaler·2022-10-28·CVSS 7.8
[HIGH] CVE-2022-37969 | Windows CLFS Zero-Day - Zscaler Blog
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Zscaler
Windows CLFS Zero-Day Vulnerability CVE-2022-37969 | Zscaler
blogs_zscaler·2022-10-14·CVSS 7.8
[HIGH] Windows CLFS Zero-Day Vulnerability CVE-2022-37969 | Zscaler
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Krebs
Wormable Flaw, 0days Lead Sept. 2022 Patch Tuesday
blogs_krebs·2022-09-14·CVSS 7.8
[HIGH] Wormable Flaw, 0days Lead Sept. 2022 Patch Tuesday
This month’s Patch Tuesday offers a little something for everyone, including security updates for a zero-day flaw in Microsoft Windows that is under active attack, and another Windows weakness experts say could be used to power a fast-spreading computer worm. Also, Apple has also quashed a pair of zero-day bugs affecting certain macOS and iOS users, and released iOS 16 , which offers a new privacy and security feature called “ Lockdown Mode .” And Adobe axed 63 vulnerabilities in a range of products.
Microsoft today released software patches to plug at least 64 security holes in Windows and related products. Worst in terms of outright scariness is CVE-2022-37969 , which is a “privilege escalation” weakness in the Windows Common Log File System Driver that allows attackers to gain SYSTEM-l
Tenable
Microsoft’s September 2022 Patch Tuesday Addresses 62 CVEs (CVE-2022-37969)
blogs_tenable·2022-09-13·CVSS 7.8
[HIGH] Microsoft’s September 2022 Patch Tuesday Addresses 62 CVEs (CVE-2022-37969)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Krebs
Wormable Flaw, 0days Lead Sept. 2022 Patch Tuesday
blogs_krebs·2022-09-13·CVSS 7.8
[HIGH] Wormable Flaw, 0days Lead Sept. 2022 Patch Tuesday
This month’s Patch Tuesday offers a little something for everyone, including security updates for a zero-day flaw in Microsoft Windows that is under active attack, and another Windows weakness experts say could be used to power a fast-spreading computer worm. Also, Apple has also quashed a pair of zero-day bugs affecting certain macOS and iOS users, and released iOS 16, which offers a new privacy and security feature called “Lockdown Mode.” And Adobe axed 63 vulnerabilities in a range of products.
Microsoft today released software patches to plug at least 64 security holes in Windows and related products. Worst in terms of outright scariness is CVE-2022-37969, which is a “privilege escalation” weakness in the Windows Common Log File System Driver that allows attackers to gain SYSTEM-level
Securelist
Kaspersky crimeware report: new ransomware and 1-day exploits
blogs_securelist·2022-08-24·CVSS 7.8
CVE-2022-24521 [HIGH] Kaspersky crimeware report: new ransomware and 1-day exploits
Table of Contents
- Introduction
- RedAlert / N13V: yet another multiplatform ransomware variant
- Monster: Ransomware with a GUI
- CVE-2022-24521: private 1-day exploits used for attacking Windows 7-11
- Conclusion
Authors
- GReAT
## Introduction
In our crimeware reporting service, we analyze the latest crime-related trends we come across. Last month, we again posted a lot on ransomware, but we also covered other subjects, such as 1-day exploits. In this blogpost, we provide excerpts from these reports.
For questions or more information about our crimeware reporting service, please contact [email protected].
## RedAlert / N13V: yet another multiplatform ransomware variant
RedAlert (aka N13V) is the latest in the multiplatform ransomware trend we described here and here
Securelist
Ransomware updates & 1-day exploits
blogs_securelist·2022-08-24·CVSS 7.8
CVE-2022-24521 [HIGH] Ransomware updates & 1-day exploits
Table of Contents
Introduction
RedAlert / N13V: yet another multiplatform ransomware variant
Monster: Ransomware with a GUI
CVE-2022-24521: private 1-day exploits used for attacking Windows 7-11
Conclusion
Authors
GReAT
## Introduction
In our crimeware reporting service, we analyze the latest crime-related trends we come across. Last month, we again posted a lot on ransomware, but we also covered other subjects, such as 1-day exploits. In this blogpost, we provide excerpts from these reports.
For questions or more information about our crimeware reporting service, please contact [email protected] .
## RedAlert / N13V: yet another multiplatform ransomware variant
RedAlert (aka N13V) is the latest in the multiplatform ransomware trend we described here and here . The d
Securelist
IT threat evolution in Q2 2022. Non-mobile statistics
blogs_securelist·2022-08-15
IT threat evolution in Q2 2022. Non-mobile statistics
Table of Contents
Quarterly figures
Financial threats
Financial threat statistics
Ransomware programs
Quarterly trends and highlights
Number of new modifications
Number of users attacked by ransomware Trojans
Geography of attacked users
TOP 10 most common families of ransomware Trojans
Miners
Number of new miner modifications
Number of users attacked by miners
Geography of miner attacks
Vulnerable applications used by criminals during cyberattacks
Quarterly highlights
Vulnerability statistics
Attacks on macOS
Geography of threats for macOS
IoT attacks
IoT threat statistics
Attacks via web resources
TOP 10 countries and territories that serve as sources of web-based attacks
Countries and territories where users faced the greatest risk of online infection
Local threat
Securelist
Non-mobile malware statistics, Q2 2022
blogs_securelist·2022-08-15
Non-mobile malware statistics, Q2 2022
Table of Contents
- Quarterly figures
- Financial threats
- Ransomware programs
- Miners
- Vulnerable applications used by criminals during cyberattacks
- Attacks on macOS
- IoT attacks
- Attacks via web resources
- Local threats
Authors
- AMR
- IT threat evolution in Q2 2022
- IT threat evolution in Q2 2022. Non-mobile statistics
- IT threat evolution in Q2 2022. Mobile statistics
These statistics are based on detection verdicts of Kaspersky products and services received from users who consented to providing statistical data.
## Quarterly figures
According to Kaspersky Security Network, in Q2 2022:
- Kaspersky solutions blocked 1,164,544,060 attacks from online resources across the globe.
- Web Anti-Virus recognized 273,033,368 unique URLs as malicious. Attempts to run malware fo
Unit42
Novel News on Cuba Ransomware: Greetings From Tropical Scorpius
blogs_unit42·2022-08-09
Novel News on Cuba Ransomware: Greetings From Tropical Scorpius
Threat Research Center
Threat Actor Groups
Ransomware
## Novel News on Cuba Ransomware: Greetings From Tropical Scorpius
Anthony Galiette
Daniel Bunce
Doel Santos
Shawn Westfall
Published: August 9, 2022
Ransomware
Threat Actor Groups
Cuba Ransomware
Investigation and Response
ROMCOM RAT
Threat intelligence
Tropical Scorpius
UNC2596
## Executive Summary
Beginning in early May 2022, Unit 42 observed a threat actor deploying Cuba Ransomware using novel tools and techniques. Using our naming schema , Unit 42 tracks the threat actor as Tropical Scorpius.
Here, we start with an overview of the ransomware and focus on an evolution of behavior observed leading up to deployment of Cuba Ransomware. While this behavior was consistent for over a year, Unit 42 has observed some
Unit42
Novel News on Cuba Ransomware: Greetings From Tropical Scorpius
blogs_unit42·2022-08-09
Novel News on Cuba Ransomware: Greetings From Tropical Scorpius
## Executive Summary
Beginning in early May 2022, Unit 42 observed a threat actor deploying Cuba Ransomware using novel tools and techniques. Using our naming schema, Unit 42 tracks the threat actor as Tropical Scorpius.
Here, we start with an overview of the ransomware and focus on an evolution of behavior observed leading up to deployment of Cuba Ransomware. While this behavior was consistent for over a year, Unit 42 has observed some recent changes. This includes providing an overview of the ransomware’s functionality and algorithms, as well as covering the technical details of the tactics, techniques and procedures (TTPs) used by Tropical Scorpius. Specifically, this involves:
- A new malware family that Unit 42 tracks as ROMCOM RAT.
- A weaponized local privilege escalation exploit
Talos
Threat Source newsletter (April 14, 2022) — It's Tax Day, and you know what that means
blogs_talos·2022-04-14
Threat Source newsletter (April 14, 2022) — It's Tax Day, and you know what that means
Welcome to this week’s edition of the Threat Source newsletter.
The deadline to file taxes in the United States is Monday. That means a few things: everyone should probably make sure their liquor cabinet is fully stocked, your spam filters are all turned on in your email and the bad guys are going to crawl out of the woodwork from every crevasse of the internet.
As Nick Biasini and I talked about on the latest Talos Takes episode, attackers always use Tax Day as a jumping-off point to launch a barrage of run-of-the-mill scam campaigns. These can range anywhere from bogus emails asking for personal information, fake tax forms sent in the mail and phone calls warning that the “IRS” will come to your home if you don’t pay the person on the other end of the phone line immediately.
The COVID
Talos
Threat Source newsletter (April 14, 2022) — It's Tax Day, and you know what that means
blogs_talos·2022-04-14
Threat Source newsletter (April 14, 2022) — It's Tax Day, and you know what that means
## Threat Source newsletter (April 14, 2022) — It's Tax Day, and you know what that means
Welcome to this week’s edition of the Threat Source newsletter.
The deadline to file taxes in the United States is Monday. That means a few things: everyone should probably make sure their liquor cabinet is fully stocked, your spam filters are all turned on in your email and the bad guys are going to crawl out of the woodwork from every crevasse of the internet.
As Nick Biasini and I talked about on the latest Talos Takes episode , attackers always use Tax Day as a jumping-off point to launch a barrage of run-of-the-mill scam campaigns . These can range anywhere from bogus emails asking for personal information, fake tax forms sent in the mail and phone calls warning that the “IRS” will come to you
Krebs
Microsoft Patch Tuesday, April 2022 Edition
blogs_krebs·2022-04-13·CVSS 9.8
CVE-2022-24521 [CRITICAL] Microsoft Patch Tuesday, April 2022 Edition
Microsoft on Tuesday released updates to fix roughly 120 security vulnerabilities in its Windows operating systems and other software. Two of the flaws have been publicly detailed prior to this week, and one is already seeing active exploitation, according to a report from the U.S. National Security Agency (NSA).
Of particular concern this month is CVE-2022-24521 , which is a “privilege escalation” vulnerability in the Windows common log file system driver. In its advisory, Microsoft said it received a report from the NSA that the flaw is under active attack.
“It’s not stated how widely the exploit is being used in the wild, but it’s likely still targeted at this point and not broadly available,” assessed Dustin Childs with Trend Micro’s Zero Day Initiative. “Go patch your systems before
Krebs
Microsoft Patch Tuesday, April 2022 Edition
blogs_krebs·2022-04-13·CVSS 9.8
CVE-2022-24521 [CRITICAL] Microsoft Patch Tuesday, April 2022 Edition
Microsoft on Tuesday released updates to fix roughly 120 security vulnerabilities in its Windows operating systems and other software. Two of the flaws have been publicly detailed prior to this week, and one is already seeing active exploitation, according to a report from the U.S. National Security Agency (NSA).
Of particular concern this month is CVE-2022-24521, which is a “privilege escalation” vulnerability in the Windows common log file system driver. In its advisory, Microsoft said it received a report from the NSA that the flaw is under active attack.
“It’s not stated how widely the exploit is being used in the wild, but it’s likely still targeted at this point and not broadly available,” assessed Dustin Childs with Trend Micro’s Zero Day Initiative. “Go patch your systems before
Qualys
April 2022 Patch Tuesday: Microsoft Releases 145 Vulnerabilities With 10 Critical; Adobe Releases 4 Advisories, 78 Vulnerabilities With 51 Critical.
blogs_qualys·2022-04-12·CVSS 8.8
[HIGH] April 2022 Patch Tuesday: Microsoft Releases 145 Vulnerabilities With 10 Critical; Adobe Releases 4 Advisories, 78 Vulnerabilities With 51 Critical.
## Table of Contents
Microsoft Patch Tuesday Summary
Notable Microsoft Vulnerabilities Patched
Notable Adobe Vulnerabilities Patched
About Qualys Patch Tuesday
Discover and Prioritize Vulnerabilities in Vulnerability Management Detection Response (VMDR)
Rapid Response With Patch Management (PM)
Monthly Webinar Series: This Month in Vulnerabilities & Patches
Join the Webinar This Month in Vulnerabilities & Patches
Contributor
## Microsoft Patch Tuesday Summary
Microsoft has fixed 145 vulnerabilities, including 17 Microsoft Edge vulnerabilities, in the April 2022 update, with ten classified as critical as they allow Remote Code Execution (RCE). This month’s Patch Tuesday release includes fixes for two zero-day vulnerabilities as well, one known to be actively exploited ( CVE-2022-
Tenable
Microsoft’s April 2022 Patch Tuesday Addresses 117 CVEs (CVE-2022-24521)
blogs_tenable·2022-04-12·CVSS 7.8
[HIGH] Microsoft’s April 2022 Patch Tuesday Addresses 117 CVEs (CVE-2022-24521)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
April 2022 Patch Tuesday: Microsoft Releases 145 Vulnerabilities With 10 Critical; Adobe Releases 4 Advisories, 78 Vulnerabilities With 51 Critical. | Qualys
blogs_qualys·2022-04-12·CVSS 8.8
[HIGH] April 2022 Patch Tuesday: Microsoft Releases 145 Vulnerabilities With 10 Critical; Adobe Releases 4 Advisories, 78 Vulnerabilities With 51 Critical. | Qualys
#### Table of Contents
- Microsoft Patch Tuesday Summary
- Notable Microsoft Vulnerabilities Patched
- Notable Adobe Vulnerabilities Patched
- About Qualys Patch Tuesday
- Discover and Prioritize Vulnerabilities in Vulnerability Management Detection Response (VMDR)
- Rapid Response With Patch Management (PM)
- Monthly Webinar Series: This Month in Vulnerabilities & Patches
- Join the Webinar This Month in Vulnerabilities & Patches
- Contributor
## Microsoft Patch Tuesday Summary
Microsoft has fixed 145 vulnerabilities, including 17 Microsoft Edge vulnerabilities, in the April 2022 update, with ten classified as critical as they allow Remote Code Execution (RCE). This month’s Patch Tuesday release includes fixes for two zero-day vulnerabilities as well, one known to be actively exploited
Zscaler
Zscaler found Windows security vulnerabilities | 04-12-2022
blogs_zscaler·CVSS 7.8
[HIGH] Zscaler found Windows security vulnerabilities | 04-12-2022
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Crowdstrike
April 2022 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] April 2022 Patch Tuesday: Updates and Analysis
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
2022-04-15
Published
2022-04-13
Added to CISA KEV
Exploited in the wild