Critical Windows Zero-Days Actively Exploited: One Flaw Hits Every Version Ever

Two Critical Zero-Day Flaws Under Active Attack

Microsoft has released urgent security patches to address two critical zero-day vulnerabilities in its Windows operating system that are being actively exploited in the wild. The security flaws, discovered and reported by researchers at Trend Micro, allow attackers to gain elevated privileges on compromised systems. One of the vulnerabilities is particularly alarming as it affects every single version of Windows ever shipped, highlighting a significant and long-standing security risk.

These exploits were identified as part of a sophisticated attack chain deployed by a notorious state-sponsored threat actor. The immediate disclosure and patching by Microsoft underscore the severity of the threat to users and organizations worldwide. A zero-day vulnerability is a software flaw unknown to the vendor, which attackers can exploit before a patch becomes available, making such attacks highly effective.

A Deep Dive into the Vulnerabilities

The two vulnerabilities grant attackers SYSTEM-level privileges, effectively giving them full control over a targeted machine. This level of access allows them to deploy further malware, exfiltrate data, and move laterally across a network.

CVE-2023-36033: A Flaw in the DWM Core Library

This vulnerability is an elevation of privilege flaw found within the Windows DWM (Desktop Window Manager) Core Library. The DWM is a fundamental component responsible for managing the graphical user interface in all modern versions of Windows. The critical nature of this bug, tracked as CVE-2023-36033, lies in its universal reach. It affects every supported version of Windows 10, Windows 11, and Windows Server, and researchers suggest the underlying flaw has existed in Windows for decades. An attacker who successfully exploits this vulnerability can gain the highest level of system privileges, bypassing nearly all security measures.

CVE-2023-36036: Windows Cloud Files Mini Filter Driver Vulnerability

The second zero-day, identified as CVE-2023-36036, is also an elevation of privilege vulnerability, but it resides in the Windows Cloud Files Mini Filter Driver. This component is related to cloud storage integration within the OS. While not as widespread as the DWM flaw, it is equally severe in its impact. Attackers can leverage this bug to escalate their access rights from a standard user to a full administrator, achieving complete system compromise.

Attribution: State-Sponsored Actors at Play

Security researchers have attributed the exploit chain utilizing these zero-days to the Russian-based threat actor known as APT28 (also tracked as Fancy Bear, Strontium, and Forest Blizzard). This group is a well-known state-sponsored cyber-espionage unit linked to Russia’s GRU military intelligence agency.

The attack chain reportedly begins with the delivery of a malicious document or link, leading to the initial compromise. The attackers then deploy custom malware loaders, which use the zero-day exploits to gain persistent, high-level access to the target’s network. The primary targets of this campaign appear to be organizations in Europe, North America, and the Middle East, with a focus on governmental, energy, and transportation sectors.

How to Protect Your Systems: Immediate Patching is Crucial

Microsoft addressed both CVE-2023-36033 and CVE-2023-36036 as part of its November 2023 Patch Tuesday release. Given that these vulnerabilities are being actively exploited, applying these security updates is the most critical step for defense. All Windows users and administrators are strongly urged to patch their systems without delay.

• Apply Updates Immediately: Ensure your Windows systems are updated with the latest security patches from Microsoft. Prioritize the installation of the November 2023 security release.
• Enable Automatic Updates: For individual users and small businesses, enabling automatic updates is the best way to ensure systems are protected against known threats as soon as patches are available.
• Monitor for Suspicious Activity: Organizations should monitor their networks for indicators of compromise associated with APT28 and other advanced threat actors.
• Employ Defense-in-Depth: Utilize a multi-layered security approach, including endpoint detection and response (EDR) solutions, to detect and block malicious behavior even if one layer of defense is bypassed.