CVE-2022-37969
published 2022-09-13CVE-2022-37969: Windows Common Log File System Driver Elevation of Privilege Vulnerability
PriorityP187high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
KEVITWEXPLOITRansomware
CISA Known Exploited Vulnerabilitydue 2022-10-05
Exploited in the wild
EPSS
28.48%
97.9th percentile
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Affected
46 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_1507 | < 10.0.10240.19444 | 10.0.10240.19444 |
| microsoft | windows_10_1607 | < 10.0.14393.5356 | 10.0.14393.5356 |
| microsoft | windows_10_1809 | < 10.0.17763.3406 | 10.0.17763.3406 |
| microsoft | windows_10_20h2 | < 10.0.19042.2006 | 10.0.19042.2006 |
| microsoft | windows_10_21h1 | < 10.0.19043.2006 | 10.0.19043.2006 |
| microsoft | windows_10_21h2 | < 10.0.19044.2006 | 10.0.19044.2006 |
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < 10.0.10240.19444 | 10.0.10240.19444 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.5356 | 10.0.14393.5356 |
| microsoft | windows_10_version_1809 | >= 10.0.0 < 10.0.17763.3406 | 10.0.17763.3406 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.3406 | 10.0.17763.3406 |
| microsoft | windows_10_version_20h2 | >= 10.0.0 < 10.0.19042.2006 | 10.0.19042.2006 |
| microsoft | windows_10_version_21h1 | >= 10.0.0 < 10.0.19043.2006 | 10.0.19043.2006 |
| microsoft | windows_10_version_21h2 | >= 10.0.19043.0 < 10.0.19044.2006 | 10.0.19044.2006 |
| microsoft | windows_11_21h2 | < 10.0.22000.978 | 10.0.22000.978 |
| microsoft | windows_11_version_21h2 | >= 10.0.0 < 10.0.22000.978 | 10.0.22000.978 |
| microsoft | windows_7 | >= 6.1.0 < 6.1.7601.26115 | 6.1.7601.26115 |
| microsoft | windows_7_service_pack_1 | >= 6.1.0 < 6.1.7601.26115 | 6.1.7601.26115 |
| microsoft | windows_8.1 | >= 6.3.0 < 6.3.9600.20571 | 6.3.9600.20571 |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.7601.0 < 6.1.7601.26115 | 6.1.7601.26115 |
| microsoft | windows_server_2008_service_pack_2 | >= 6.0.6003.0 < 6.0.6003.21666 | 6.0.6003.21666 |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012 | >= 6.2.9200.0 < 6.2.9200.23865 | 6.2.9200.23865 |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.20571 | 6.3.9600.20571 |
| microsoft | windows_server_2016 | < 10.0.14393.5356 | 10.0.14393.5356 |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect exploit targeting CVE-2022-37969 via manipulation of BLF (base log file) structures: monitor for processes calling AddLogContainer API after patching cbSymbolZone or SignaturesOffset fields in a BLF file, which causes CLFS_CLIENT_CONTEXT and CLFS_CONTAINER_CONTEXT to overlap. ↗
- →Detect token replacement privilege escalation: monitor for a user-mode process whose _EPROCESS.Token (offset 0x4B8 on Win11 21H2) is overwritten with the SYSTEM process (PID 4) token — indicative of CVE-2022-37969 post-exploitation. ↗
- →Monitor for NtFsControlFile calls with FsControlCode 0x11003C (create pipe attribute) and 0x110038 (read pipe attribute) from non-system processes, which are used by the CVE-2022-37969 exploit for kernel object manipulation via PipeAttribute structures. ↗
- →BianLian ransomware exploits CVE-2022-37969 for privilege escalation on Windows 10 and 11; also uses Ngrok and modified Rsocks for SOCKS5 tunneling, UPX-packed binaries, and renames binaries/tasks after legitimate Windows services for evasion. ↗
- →The CVE-2022-37969 exploit checks the OS build number from _PEB->OSBuildNumber (offset 0x120) and queries UBR from registry to confirm target version before proceeding — detecting this registry query in combination with CLFS API usage may indicate exploit activity. ↗
- ·The exploit for CVE-2022-37969 requires the attacker to already be authenticated with user-level access and able to execute code on the target — it is a local privilege escalation, not a remote code execution. ↗
- ·The September 2022 exploit variant (Exploit #2) differs from the Zscaler-described CVE-2022-37969 exploit; it is more similar to the CVE-2022-24521 exploit and was likely created by the same author, but patches different BLF fields. ↗
- ·The October 2022 exploit (Exploit #3) works against the September 2022 patch but not the October 2022 patch; it was observed in attacks only after the October patch was released, suggesting possible prior zero-day use with greater operational caution. ↗
- ·NtQuerySystemInformation with SystemExtendedHandleInformation (0x40) requires Medium Integrity Level (Medium IL) to work; the exploit's kernel address leak technique will not function from low-integrity processes. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vulncheck7.8HIGH
cisa7.8HIGH
vendor_msrc7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vp7q-rg64-pxr9: Windows Common Log File System Driver Elevation of Privilege Vulnerability
ghsa_unreviewed·2022-09-14·CVSS 7.8
CVE-2022-37969 [HIGH] CWE-787 GHSA-vp7q-rg64-pxr9: Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-35803.
GHSA
GHSA-632j-4r76-qfq7: Windows Common Log File System Driver Elevation of Privilege Vulnerability
ghsa_unreviewed·2022-09-14·CVSS 7.8
CVE-2022-35803 [HIGH] GHSA-632j-4r76-qfq7: Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-37969.
VulnCheck
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
vulncheck·2022·CVSS 7.8
CVE-2022-37969 [HIGH] CWE-20 Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
Affected: Microsoft Windows
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2022-Sep; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37969; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.zscaler.com/blogs/security-research/technical-analysis-windows-clfs-zero-day-vulnerability-cve-2022-37969-part; https://www.zscaler.com/blogs/security-research/technical-analysis-windows-clfs-zero-day-vuln
Project0
Project Zero RCA: CVE-2023-36802: Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability
project_zero·CVSS 7.8
CVE-2023-36802 [HIGH] Project Zero RCA: CVE-2023-36802: Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability
# CVE-2023-36802: Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability
*Benoît Sevens*
## The Basics
**Disclosure or Patch Date:** September 12, 2023
**Product:** Windows
**Advisory:** https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36802
**Affected Versions:**
* Windows 10 without KB5030211 or KB5030214
* Windows 11 without KB5030219 or KB5030217
* Windows Server 2019 without KB5030214
* Windows Server 2022 without KB5030216 or KB503025
**First Patched Version:**
* Windows 10 with KB5030211 or KB5030214
* Windows 11 with KB5030219 or KB5030217
* Windows Server 2019 with KB5030214
* Windows Server 2022 with KB5030216 or KB503025
**Issue/Bug Report:** N/A
**Patch CL:** N/A
**Bug-Introducing CL:** N/A
**Reporter(s):**
* Guanghui Xia (@ze0r) with
Project0
Project Zero RCA: CVE-2023-28252: Windows Common Log File System Driver Elevation of Privilege Vulnerability
project_zero·CVSS 7.8
CVE-2023-28252 [HIGH] Project Zero RCA: CVE-2023-28252: Windows Common Log File System Driver Elevation of Privilege Vulnerability
# CVE-2023-28252: Windows Common Log File System Driver Elevation of Privilege Vulnerability
*Genwei Jiang, FLARE OTF*
## The Basics
**Disclosure or Patch Date:** April 11, 2023
**Product:** Windows
**Advisory:** https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-28252
**Affected Versions:** Before security updates of April 11, 2023, for Windows 10, 11 and Windows Server 2008, 2012, 2016, 2019, 2022
**First Patched Version:** Security updates of April 11, 2023, for CVE-2023-28252
**Issue/Bug Report:** MSRC-78564
**Patch CL:** N/A
**Bug-Introducing CL:** N/A
**Reporter(s):** Boris Larin (oct0xor) with Kaspersky, Genwei Jiang with FLARE OTF of Google Cloud + Mandiant, Quan Jin with DBAPPSecurity WeBin Lab
## The Code
**Proof-of-concept:** See exploit sample
**E
CISA
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
cisa·2022-09-14·CVSS 7.8
CVE-2022-37969 [HIGH] CWE-20 Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Vulnerability: Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Affected: Microsoft Windows
Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
Required Action: Apply updates per vendor instructions.
Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-37969; https://nvd.nist.gov/vuln/detail/CVE-2022-37969
Remediation Due Date: 2022-10-05
Microsoft
Windows Common Log File System Driver Elevation of Privilege Vulnerability
vendor_msrc·2022-09-13·CVSS 7.8
CVE-2022-37969 [HIGH] Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
FAQ: What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
FAQ: According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
An attacker must already have access and the ability to run code on the target system. This technique does not allow for remote code execution in cases where the attacker does not already have that ability on the target system.
Windows Common Log File System Driver: Windows Common Log File System Driver
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Elevation of Privilege
Exploit Status: Publicly Discl
No detection rules found.
No public exploits indexed.
Greynoiseio
GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs
blogs_greynoiseio·2025-02-26·CVSS 9.8
[CRITICAL] GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Qualys
Defense Lessons From the Black Basta Ransomware Playbook
blogs_qualys·2025-02-25
Defense Lessons From the Black Basta Ransomware Playbook
## Table of Contents
Know Your Enemys Playbook
Attackers Move Fast
How Qualys Can Help
The cybersecurity world was rocked last week by a massive leak of Black Basta’s internal communications that emerged from the group’s chat logs. Triggered by internal conflicts and a retaliatory data dump following attacks on Russian banks, the exposed records offer a rare glimpse into Black Basta’s tactics, operations, and leadership.
We’ve analyzed these newly unveiled tactics, and in this blog, we equip security teams with clear, actionable insights. We aim to highlight the key lessons learned—like immediate patching, tighter access controls, and rapid incident response—and provide an urgent call to action. This practical guide aims to help organizations strengthen their defenses against evolving
Qualys
Defense Lessons From the Black Basta Ransomware Playbook | Qualys
blogs_qualys·2025-02-25
Defense Lessons From the Black Basta Ransomware Playbook | Qualys
#### Table of Contents
- Know Your Enemys Playbook
- Attackers Move Fast
- How Qualys Can Help
The cybersecurity world was rocked last week by a massive leak of Black Basta’s internal communications that emerged from the group’s chat logs. Triggered by internal conflicts and a retaliatory data dump following attacks on Russian banks, the exposed records offer a rare glimpse into Black Basta’s tactics, operations, and leadership.
We’ve analyzed these newly unveiled tactics, and in this blog, we equip security teams with clear, actionable insights. We aim to highlight the key lessons learned—like immediate patching, tighter access controls, and rapid incident response—and provide an urgent call to action. This practical guide aims to help organizations strengthen their defenses against ev
Bleepingcomputer
CISA says BianLian ransomware now focuses only on data theft
blogs_bleepingcomputer·2024-11-21·CVSS 6.6
[MEDIUM] CISA says BianLian ransomware now focuses only on data theft
## CISA says BianLian ransomware now focuses only on data theft
## Bill Toulas
The BianLian ransomware operation has shifted its tactics, becoming primarily a data theft extortion group, according to an updated advisory from the U.S. Cybersecurity & Infrastructure Security Agency, the FBI, and the Australian Cyber Security Centre.
This new information comes in an update to a joint advisory released in May by the same agencies, which warned about BianLian's shifting tactics involving the use of stolen Remote Desktop Protocol (RDP) credentials, custom Go-based backdoors, commercial remote access tools, and targeted Windows Registry modifications.
At the time, BianLian had started a switch to data theft extortion , gradually abandoning file encryption tactics, especially after Avast relea
Elastic
In-the-Wild Windows LPE 0-days: Insights & Detection Strategies — Elastic Security Labs
blogs_elastic·2024-03-29
In-the-Wild Windows LPE 0-days: Insights & Detection Strategies — Elastic Security Labs
29 March 2024•Samir Bousseaden
# In-the-Wild Windows LPE 0-days: Insights & Detection Strategies
This article will evaluate detection methods for Windows local privilege escalation techniques based on dynamic behaviors analysis using Elastic Defend features.
7 min readDetection Engineering, Enablement
Based on disclosures from Microsoft, Google, Kaspersky, Checkpoint, and other industry players, it has become apparent that in-the-wild Windows local privilege escalation (LPE) zero-days are increasingly prevalent and essential components in sophisticated cybercrime and APT arsenals. It is important for detection engineers to closely examine these publicly accessible samples and assess possible avenues for detection.
This article will not delve into the root cause or specific details of
Elastic
In-the-Wild Windows LPE 0-days: Insights & Detection Strategies — Elastic Security Labs
blogs_elastic·2024-03-29
In-the-Wild Windows LPE 0-days: Insights & Detection Strategies — Elastic Security Labs
## In-the-Wild Windows LPE 0-days: Insights & Detection Strategies
This article will evaluate detection methods for Windows local privilege escalation techniques based on dynamic behaviors analysis using Elastic Defend features.
Based on disclosures from Microsoft , Google , Kaspersky , Checkpoint , and other industry players, it has become apparent that in-the-wild Windows local privilege escalation (LPE) zero-days are increasingly prevalent and essential components in sophisticated cybercrime and APT arsenals. It is important for detection engineers to closely examine these publicly accessible samples and assess possible avenues for detection.
This article will not delve into the root cause or specific details of the vulnerabilities; however, we do provide links to appropriate vulnera
Securelist
Windows CLFS and five exploits used by ransomware operators (Exploit #3 – October 2022)
blogs_securelist·2023-12-21·CVSS 7.8
[HIGH] Windows CLFS and five exploits used by ransomware operators (Exploit #3 – October 2022)
Authors
- Boris Larin
This is part four of our study about the Common Log File System (CLFS) and five vulnerabilities in this Windows OS component that have been used in ransomware attacks throughout the year. Please read the previous parts first if you haven’t already.
You can skip to the other parts using this table of contents or using the link at the end of this part.
- Part 1 – Windows CLFS and five exploits of ransomware operators
- Part 2 – Windows CLFS and five exploits of ransomware operators (Exploit #1 – CVE-2022-24521)
- Part 3 – Windows CLFS and five exploits of ransomware operators (Exploit #2 – September 2022)
- Part 4 – Windows CLFS and five exploits of ransomware operators (Exploit #3 – October 2022)
- Part 5 – Windows CLFS and five exploits of ransomware operators (Ex
Securelist
Windows CLFS and five exploits used by ransomware operators (Exploit #2 – September 2022)
blogs_securelist·2023-12-21·CVSS 7.8
[HIGH] Windows CLFS and five exploits used by ransomware operators (Exploit #2 – September 2022)
Authors
Boris Larin
This is the third part of our study about the Common Log File System (CLFS) and five vulnerabilities in this Windows OS component that have been used in ransomware attacks throughout the year. Please read the previous parts first if you haven’t already.
You can skip to the other parts using this table of contents or using the link at the end of this part.
Part 1 – Windows CLFS and five exploits of ransomware operators
Part 2 – Windows CLFS and five exploits of ransomware operators (Exploit #1 – CVE-2022-24521)
Part 3 – Windows CLFS and five exploits of ransomware operators (Exploit #2 – September 2022)
Part 4 – Windows CLFS and five exploits of ransomware operators (Exploit #3 – October 2022)
Part 5 – Windows CLFS and five exploits of ransomware operators (Explo
Securelist
Windows CLFS and five exploits used by ransomware operators (Exploit #2 – September 2022)
blogs_securelist·2023-12-21·CVSS 7.8
[HIGH] Windows CLFS and five exploits used by ransomware operators (Exploit #2 – September 2022)
Authors
- Boris Larin
This is the third part of our study about the Common Log File System (CLFS) and five vulnerabilities in this Windows OS component that have been used in ransomware attacks throughout the year. Please read the previous parts first if you haven’t already.
You can skip to the other parts using this table of contents or using the link at the end of this part.
- Part 1 – Windows CLFS and five exploits of ransomware operators
- Part 2 – Windows CLFS and five exploits of ransomware operators (Exploit #1 – CVE-2022-24521)
- Part 3 – Windows CLFS and five exploits of ransomware operators (Exploit #2 – September 2022)
- Part 4 – Windows CLFS and five exploits of ransomware operators (Exploit #3 – October 2022)
- Part 5 – Windows CLFS and five exploits of ransomware operator
Securelist
Windows CLFS and five exploits used by ransomware operators
blogs_securelist·2023-12-21·CVSS 7.8
CVE-2023-28252 [HIGH] Windows CLFS and five exploits used by ransomware operators
Authors
- Boris Larin
In April 2023, we published a blog post about a zero-day exploit we discovered in ransomware attacks that was patched as CVE-2023-28252 after we promptly reported it to Microsoft.
In that blog post, we mentioned that the zero-day exploit we discovered was very similar to other Microsoft Windows elevation-of-privilege (EoP) exploits that we have seen in ransomware attacks throughout the year. We found that since June 2022, attackers have used exploits for at least five different Common Log File System (CLFS) driver vulnerabilities. Four of these vulnerabilities used by the attackers (CVE-2022-24521, CVE-2022-37969, CVE-2023-23376, CVE-2023-28252) have been captured in the wild as zero-days.
Seeing a Win32k driver zero-day being used in attacks isn’t really surprisi
Securelist
Windows CLFS and five exploits used by ransomware operators (Exploit #3 – October 2022)
blogs_securelist·2023-12-21·CVSS 7.8
[HIGH] Windows CLFS and five exploits used by ransomware operators (Exploit #3 – October 2022)
Authors
Boris Larin
This is part four of our study about the Common Log File System (CLFS) and five vulnerabilities in this Windows OS component that have been used in ransomware attacks throughout the year. Please read the previous parts first if you haven’t already.
You can skip to the other parts using this table of contents or using the link at the end of this part.
Part 1 – Windows CLFS and five exploits of ransomware operators
Part 2 – Windows CLFS and five exploits of ransomware operators (Exploit #1 – CVE-2022-24521)
Part 3 – Windows CLFS and five exploits of ransomware operators (Exploit #2 – September 2022)
Part 4 – Windows CLFS and five exploits of ransomware operators (Exploit #3 – October 2022)
Part 5 – Windows CLFS and five exploits of ransomware operators (Exploit #4
Securelist
Windows CLFS and five exploits used by ransomware operators
blogs_securelist·2023-12-21·CVSS 7.8
CVE-2023-28252 [HIGH] Windows CLFS and five exploits used by ransomware operators
Authors
Boris Larin
In April 2023, we published a blog post about a zero-day exploit we discovered in ransomware attacks that was patched as CVE-2023-28252 after we promptly reported it to Microsoft.
In that blog post, we mentioned that the zero-day exploit we discovered was very similar to other Microsoft Windows elevation-of-privilege (EoP) exploits that we have seen in ransomware attacks throughout the year. We found that since June 2022, attackers have used exploits for at least five different Common Log File System (CLFS) driver vulnerabilities. Four of these vulnerabilities used by the attackers ( CVE-2022-24521 , CVE-2022-37969 , CVE-2023-23376 , CVE-2023-28252 ) have been captured in the wild as zero-days.
Seeing a Win32k driver zero-day being used in attacks isn’t really surpr
Talos
Threat Source newsletter (April 13, 2023) — Dark web forum whac-a-mole
blogs_talos·2023-04-13
Threat Source newsletter (April 13, 2023) — Dark web forum whac-a-mole
Welcome to this week’s edition of the Threat Source newsletter.
Law enforcement organizations across the globe notched a series of wins over the past few weeks against online forums for cybercriminals.
On March 23, the FBI announced it disrupted the online cybercriminal marketplace BreachForums, known for being a place where users could buy and sell stolen user information. They also arrested a 20-year-old suspected of being the site’s founder and main administrator.
Then last week we had “Operation Cookie Monster” in which several international agencies worked together to take down Genesis Market, a similar dark web forum, arresting dozens of suspected users and administrators.
These arrests and network operations are important in that they disrupted sites that were known for highly s
Talos
Threat Source newsletter (April 13, 2023) — Dark web forum whac-a-mole
blogs_talos·2023-04-13
Threat Source newsletter (April 13, 2023) — Dark web forum whac-a-mole
## Threat Source newsletter (April 13, 2023) — Dark web forum whac-a-mole
Welcome to this week’s edition of the Threat Source newsletter.
Law enforcement organizations across the globe notched a series of wins over the past few weeks against online forums for cybercriminals.
On March 23, the FBI announced it disrupted the online cybercriminal marketplace BreachForums , known for being a place where users could buy and sell stolen user information. They also arrested a 20-year-old suspected of being the site’s founder and main administrator.
Then last week we had “Operation Cookie Monster” in which several international agencies worked together to take down Genesis Market , a similar dark web forum, arresting dozens of suspected users and administrators.
These arrests and network opera
Krebs
Microsoft (& Apple) Patch Tuesday, April 2023 Edition
blogs_krebs·2023-04-12·CVSS 8.8
CVE-2023-28206 [HIGH] Microsoft (& Apple) Patch Tuesday, April 2023 Edition
Microsoft today released software updates to plug 100 security holes in its Windows operating systems and other software, including a zero-day vulnerability that is already being used in active attacks. Not to be outdone, Apple has released a set of important updates addressing two zero-day vulnerabilities that are being used to attack iPhones , iPads and Macs .
On April 7, Apple issued emergency security updates to fix two weaknesses that are being actively exploited, including CVE-2023-28206 , which can be exploited by apps to seize control over a device. CVE-2023-28205 can be used by a malicious or hacked website to install code.
Both vulnerabilities are addressed in iOS/iPadOS 16.4.1, iOS 15.7.5, and macOS 12.6.5 and 11.7.6 . If you use Apple devices and you don’t have automatic upda
Securelist
Nokoyawa ransomware attacks with Windows zero-day
blogs_securelist·2023-04-11·CVSS 7.8
[HIGH] Nokoyawa ransomware attacks with Windows zero-day
Table of Contents
- Elevation-of-privilege exploit
- Post exploitation and malware
- Conclusions
- Indicators of compromise
Authors
- Boris Larin
Updated April 20, 2023
In February 2023, Kaspersky technologies detected a number of attempts to execute similar elevation-of-privilege exploits on Microsoft Windows servers belonging to small and medium-sized businesses in the Middle East, in North America, and previously in Asia regions. These exploits were very similar to already known Common Log File System (CLFS) driver exploits that we analyzed previously, but we decided to double check and it was worth it – one of the exploits turned out to be a zero-day, supporting different versions and builds of Windows, including Windows 11. The exploit was highly obfuscated with more than 80% of
Talos
Microsoft Patch Tuesday for April 2023 — Snort rules and prominent vulnerabilities
blogs_talos·2023-04-11·CVSS 7.8
CVE-2023-28252 [HIGH] Microsoft Patch Tuesday for April 2023 — Snort rules and prominent vulnerabilities
## Microsoft Patch Tuesday for April 2023 — Snort rules and prominent vulnerabilities
Microsoft released its monthly round of security updates and patches today, continuing its trend of fixing zero-day vulnerabilities on Patch Tuesday.
April's security update includes one vulnerability that’s actively being exploited in the wild. There are also eight critical vulnerabilities and the remaining 90 are considered “important.”
CVE-2023-28252 , an elevation of privilege vulnerability in the Windows Common Log File System Driver, is actively being exploited in the wild, according to Microsoft, though proof of concept code is not currently available. An adversary could exploit this vulnerability to gain SYSTEM privileges.
The U.S. Cybersecurity and Infrastructure Security Agency already added
Talos
Microsoft Patch Tuesday for April 2023 — Snort rules and prominent vulnerabilities
blogs_talos·2023-04-11·CVSS 7.8
CVE-2023-28252 [HIGH] Microsoft Patch Tuesday for April 2023 — Snort rules and prominent vulnerabilities
Microsoft released its monthly round of security updates and patches today, continuing its trend of fixing zero-day vulnerabilities on Patch Tuesday.
April's security update includes one vulnerability that’s actively being exploited in the wild. There are also eight critical vulnerabilities and the remaining 90 are considered “important.”
CVE-2023-28252, an elevation of privilege vulnerability in the Windows Common Log File System Driver, is actively being exploited in the wild, according to Microsoft, though proof of concept code is not currently available. An adversary could exploit this vulnerability to gain SYSTEM privileges.
The U.S. Cybersecurity and Infrastructure Security Agency already added the vulnerability to its list of know exploited issues and urged federal agencies to pa
Tenable
Microsoft’s April 2023 Patch Tuesday Addresses 97 CVEs (CVE-2023-28252)
blogs_tenable·2023-04-11·CVSS 7.8
[HIGH] Microsoft’s April 2023 Patch Tuesday Addresses 97 CVEs (CVE-2023-28252)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Securelist
Nokoyawa ransomware attacks with Windows zero-day
blogs_securelist·2023-04-11·CVSS 7.8
[HIGH] Nokoyawa ransomware attacks with Windows zero-day
Table of Contents
Elevation-of-privilege exploit
Post exploitation and malware
Conclusions
Indicators of compromise
Authors
Boris Larin
Updated April 20, 2023
In February 2023, Kaspersky technologies detected a number of attempts to execute similar elevation-of-privilege exploits on Microsoft Windows servers belonging to small and medium-sized businesses in the Middle East, in North America, and previously in Asia regions. These exploits were very similar to already known Common Log File System (CLFS) driver exploits that we analyzed previously, but we decided to double check and it was worth it – one of the exploits turned out to be a zero-day, supporting different versions and builds of Windows, including Windows 11. The exploit was highly obfuscated with more than 80% of the its
Krebs
Microsoft (& Apple) Patch Tuesday, April 2023 Edition
blogs_krebs·2023-04-11·CVSS 8.8
CVE-2023-28206 [HIGH] Microsoft (& Apple) Patch Tuesday, April 2023 Edition
Microsoft today released software updates to plug 100 security holes in its Windows operating systems and other software, including a zero-day vulnerability that is already being used in active attacks. Not to be outdone, Apple has released a set of important updates addressing two zero-day vulnerabilities that are being used to attack iPhones, iPads and Macs.
On April 7, Apple issued emergency security updates to fix two weaknesses that are being actively exploited, including CVE-2023-28206, which can be exploited by apps to seize control over a device. CVE-2023-28205 can be used by a malicious or hacked website to install code.
Both vulnerabilities are addressed in iOS/iPadOS 16.4.1, iOS 15.7.5, and macOS 12.6.5 and 11.7.6. If you use Apple devices and you don’t have automatic updates
Tenable
Microsoft’s February 2023 Patch Tuesday Addresses 75 CVEs (CVE-2023-23376)
blogs_tenable·2023-02-14·CVSS 7.8
[HIGH] Microsoft’s February 2023 Patch Tuesday Addresses 75 CVEs (CVE-2023-23376)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Securelist
IT threat evolution in Q3 2022. Non-mobile statistics
blogs_securelist·2022-11-18
IT threat evolution in Q3 2022. Non-mobile statistics
Table of Contents
Quarterly figures
Financial threats
Number of users attacked by banking malware
TOP 10 banking malware families
Geography of financial malware attacks
Ransomware programs
Quarterly trends and highlights
Number of new modifications
Number of users attacked by ransomware Trojans
Geography of attacked users
TOP 10 most common families of ransomware Trojans
Miners
Number of new miner modifications
Number of users attacked by miners
Geography of miner attacks
Vulnerable applications used by criminals during cyberattacks
Quarterly highlights
Vulnerability statistics
Attacks on macOS
TOP 20 threats for macOS
Geography of threats for macOS
IoT attacks
IoT threat statistics
Attacks via web resources
Countries and territories that serve as sources of web-ba
Securelist
PC malware statistics, Q3 2022
blogs_securelist·2022-11-18
PC malware statistics, Q3 2022
Table of Contents
- Quarterly figures
- Financial threats
- Ransomware programs
- Miners
- Vulnerable applications used by criminals during cyberattacks
- Attacks on macOS
- IoT attacks
- Attacks via web resources
- Local threats
Authors
- AMR
- IT threat evolution in Q3 2022
- IT threat evolution in Q3 2022. Non-mobile statistics
- IT threat evolution in Q3 2022. Mobile statistics
These statistics are based on detection verdicts of Kaspersky products and services received from users who consented to providing statistical data.
## Quarterly figures
According to Kaspersky Security Network, in Q3 2022:
- Kaspersky solutions blocked 956,074,958 attacks from online resources across the globe.
- Web Anti-Virus recognized 251,288,987 unique URLs as malicious.
- Attempts to run malware fo
Zscaler
CVE-2022-37969 | Windows CLFS Zero-Day - Zscaler Blog
blogs_zscaler·2022-10-28·CVSS 7.8
[HIGH] CVE-2022-37969 | Windows CLFS Zero-Day - Zscaler Blog
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Zscaler
Windows CLFS Zero-Day Vulnerability CVE-2022-37969 | Zscaler
blogs_zscaler·2022-10-14·CVSS 7.8
[HIGH] Windows CLFS Zero-Day Vulnerability CVE-2022-37969 | Zscaler
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Checkpoint
19th September – Threat Intelligence Report
blogs_checkpoint·2022-09-19
CVE-2022-29499 19th September – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 19th September – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 19th September, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Uber has suffered a data breach, allegedly by an 18-year-old hacker who managed to gain access using social engineering tactics on an employee. The hacker claims to have access to Uber’s internal IT systems and to the company’s HackerOne bug bounty account, which contains vulnerabilities in Uber’s systems and apps, di
Krebs
Wormable Flaw, 0days Lead Sept. 2022 Patch Tuesday
blogs_krebs·2022-09-14·CVSS 7.8
[HIGH] Wormable Flaw, 0days Lead Sept. 2022 Patch Tuesday
This month’s Patch Tuesday offers a little something for everyone, including security updates for a zero-day flaw in Microsoft Windows that is under active attack, and another Windows weakness experts say could be used to power a fast-spreading computer worm. Also, Apple has also quashed a pair of zero-day bugs affecting certain macOS and iOS users, and released iOS 16 , which offers a new privacy and security feature called “ Lockdown Mode .” And Adobe axed 63 vulnerabilities in a range of products.
Microsoft today released software patches to plug at least 64 security holes in Windows and related products. Worst in terms of outright scariness is CVE-2022-37969 , which is a “privilege escalation” weakness in the Windows Common Log File System Driver that allows attackers to gain SYSTEM-l
Talos
Microsoft Patch Tuesday for September 2022 — Snort rules and prominent vulnerabilities
blogs_talos·2022-09-13·CVSS 8.8
[HIGH] Microsoft Patch Tuesday for September 2022 — Snort rules and prominent vulnerabilities
## Microsoft Patch Tuesday for September 2022 — Snort rules and prominent vulnerabilities
Microsoft released its monthly security update Tuesday, disclosing 64 vulnerabilities across the company’s hardware and software line, a sharp decline from the record number of issues Microsoft disclosed last month.
September's security update features five critical vulnerabilities, 10 fewer than were included in last month’s Patch Tuesday. There are two moderate-severity vulnerabilities in this release and a low-security issue that’s already been patched as a part of a recent Google Chromium update. The remainder is considered “important.”
The most serious vulnerability exists in several versions of Windows Server and Windows 10 that could allow an attacker to gain the ability to execute remote co
Tenable
Microsoft’s September 2022 Patch Tuesday Addresses 62 CVEs (CVE-2022-37969)
blogs_tenable·2022-09-13·CVSS 7.8
[HIGH] Microsoft’s September 2022 Patch Tuesday Addresses 62 CVEs (CVE-2022-37969)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
September 2022 Patch Tuesday | Microsoft Releases 63 Vulnerabilities With 5 Critical, Plus 16 Microsoft Edge (Chromium-Based); Adobe Releases 7 Advisories, 63 Vulnerabilities With 35 Critical.
blogs_qualys·2022-09-13·CVSS 5.6
[MEDIUM] September 2022 Patch Tuesday | Microsoft Releases 63 Vulnerabilities With 5 Critical, Plus 16 Microsoft Edge (Chromium-Based); Adobe Releases 7 Advisories, 63 Vulnerabilities With 35 Critical.
## Table of Contents
Microsoft Patch Tuesday Summary
The September 2022 Microsoft Vulnerabilities Are Classified As Follows:
Notable Microsoft Vulnerabilities Patched
Zero-Day Vulnerabilities Addressed
Microsoft Important Vulnerability Highlights
Microsoft Edge | Last But Not Least
Adobe Security Bulletins and Advisories
About Qualys Patch Tuesday
Qualys Threat Protection High-Rated Advisories from August to September 2022 Patch Tuesday Advisory
Discover and Prioritize Vulnerabilities in Vulnerability Management Detection Response (VMDR)
Rapid Response With Patch Management (PM)
Evaluate Vendor-Suggested Workarounds With Policy Compliance
Qualys This Month in Vulnerabilities and Patches Webinar Series
Join the Webinar This Month in Vulnerabilities & Patches
NEW & NOTEWORTHY
Talos
Microsoft Patch Tuesday for September 2022 — Snort rules and prominent vulnerabilities
blogs_talos·2022-09-13·CVSS 8.8
[HIGH] Microsoft Patch Tuesday for September 2022 — Snort rules and prominent vulnerabilities
Microsoft released its monthly security update Tuesday, disclosing 64 vulnerabilities across the company’s hardware and software line, a sharp decline from the record number of issues Microsoft disclosed last month.
September's security update features five critical vulnerabilities, 10 fewer than were included in last month’s Patch Tuesday. There are two moderate-severity vulnerabilities in this release and a low-security issue that’s already been patched as a part of a recent Google Chromium update. The remainder is considered “important.”
The most serious vulnerability exists in several versions of Windows Server and Windows 10 that could allow an attacker to gain the ability to execute remote code (RCE) by sending a singular, specially crafted IPv6 packet to a Windows node where IPSec
Qualys
September 2022 Patch Tuesday | Microsoft Releases 63 Vulnerabilities With 5 Critical, Plus 16 Microsoft Edge (Chromium-Based); Adobe Releases 7 Advisories, 63 Vulnerabilities With 35 Critical. | Qualy
blogs_qualys·2022-09-13·CVSS 5.6
[MEDIUM] September 2022 Patch Tuesday | Microsoft Releases 63 Vulnerabilities With 5 Critical, Plus 16 Microsoft Edge (Chromium-Based); Adobe Releases 7 Advisories, 63 Vulnerabilities With 35 Critical. | Qualy
#### Table of Contents
- Microsoft Patch Tuesday Summary
- The September 2022 Microsoft Vulnerabilities Are Classified As Follows:
- Notable Microsoft Vulnerabilities Patched
- Zero-Day Vulnerabilities Addressed
- Microsoft Important Vulnerability Highlights
- Microsoft Edge | Last But Not Least
- Adobe Security Bulletins and Advisories
- About Qualys Patch Tuesday
- Qualys Threat Protection High-Rated Advisories from August to September 2022 Patch Tuesday Advisory
- Discover and Prioritize Vulnerabilities in Vulnerability Management Detection Response (VMDR)
- Rapid Response With Patch Management (PM)
- Evaluate Vendor-Suggested Workarounds With Policy Compliance
- Qualys This Month in Vulnerabilities and Patches Webinar Series
- Join the Webinar This Month in Vulnerabilities & Patches
-
Krebs
Wormable Flaw, 0days Lead Sept. 2022 Patch Tuesday
blogs_krebs·2022-09-13·CVSS 7.8
[HIGH] Wormable Flaw, 0days Lead Sept. 2022 Patch Tuesday
This month’s Patch Tuesday offers a little something for everyone, including security updates for a zero-day flaw in Microsoft Windows that is under active attack, and another Windows weakness experts say could be used to power a fast-spreading computer worm. Also, Apple has also quashed a pair of zero-day bugs affecting certain macOS and iOS users, and released iOS 16, which offers a new privacy and security feature called “Lockdown Mode.” And Adobe axed 63 vulnerabilities in a range of products.
Microsoft today released software patches to plug at least 64 security holes in Windows and related products. Worst in terms of outright scariness is CVE-2022-37969, which is a “privilege escalation” weakness in the Windows Common Log File System Driver that allows attackers to gain SYSTEM-level
Zscaler
CISO Monthly Roundup, October 2022: ThreatLabz Data Loss Report; PHP Ducktail infostealer; LilithBot malware; vulnerabilities in OpenSSL, Microsoft, and Apache; Windows CLFS zero-day | CXO Revolutiona
blogs_zscaler
CISO Monthly Roundup, October 2022: ThreatLabz Data Loss Report; PHP Ducktail infostealer; LilithBot malware; vulnerabilities in OpenSSL, Microsoft, and Apache; Windows CLFS zero-day | CXO Revolutiona
## CISO Monthly Roundup, October 2022: ThreatLabz Data Loss Report; PHP Ducktail infostealer; LilithBot malware; vulnerabilities in OpenSSL, Microsoft, and Apache; Windows CLFS zero-day
Deepen Desai
Contributor
Zscaler
## Nov 2, 2022
The CISO Monthly Roundup (formerly the ThreatLabz monthly report) provides the latest threat research and relevant insights on cyber-related subjects from the ThreatLabz team and Deepen Desai, CISO at Zscaler.
The CISO Monthly Roundup (formerly the ThreatLabz monthly report) provides the latest threat research from Deepen Desai and the ThreatLabz team, along with insights on other cyber-related subjects. In October, ThreatLabz released their 2022 Data Loss Report, researched a PHP version of Ducktail infostealer, and analyzed LilithBot malware. My team a
Crowdstrike
September Patch Tuesday 2022: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] September Patch Tuesday 2022: Updates and Analysis
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
2022-09-13
Published
2022-09-14
Added to CISA KEV
Exploited in the wild