Monday, May 19, 2025
HomeComputer SecurityHackers Actively Exploiting the Recently Patched Windows kernel Zero-day Vulnerability in Wild

Hackers Actively Exploiting the Recently Patched Windows kernel Zero-day Vulnerability in Wild

Published on

SIEM as a Service

Follow Us on Google News

Threat actors exploiting the recently patched Windows Kernel Privilege Escalation Vulnerability (CVE-2018-8611) that allows attackers to run arbitrary code in kernel mode and install program with admin privileges.

The vulnerability is due to the improper file execution operations in the kernel mode. Security researchers from Kaspersky uncovered the zero-day vulnerability and it has been reported to Microsoft on October 29, 2018, and Microsoft patched with December security update.

A number of APT groups use the exploit including FruityArmor, CHAINSHOT, and the newly discovered SandCat.

- Advertisement - Google News

“This vulnerability successfully bypasses modern process mitigation policies, such as Win32k System call Filtering that is used, among others, in the Microsoft Edge Sandbox and the Win32k Lockdown Policy employed in the Google Chrome Sandbox.”

It leads to gain full remote command execution with the latest browser versions. Kaspersky researchers spotted multiple builds of the exploit for the vulnerability that is compatible with the latest Windows operating system versions.

In order to abuse the vulnerability, the exploit first creates a pipe and create a pair of new objects and number of enlistment objects. The Enlistment object is for the association between the transaction and a resource manager.

Image: Kaspersky

Kaspersky Lab detected this zero-day flaw using following 2 technologies.

  1. Behavioral detection engine and Automatic Exploit Prevention for endpoint products
  2. Advanced Sandboxing and Anti Malware engine for Kaspersky Anti Targeted Attack Platform (KATA)

Once it succeeds with the initial preparation it moves to the second stage where it creates the multiple numbers of threads and bind to a single CPU core.

The vulnerability will be triggered in the third-stage of the thread, Successful execution of NtRecoverResourceManager will mean that race condition has occurred.

Kaspersky said the campaign actively targeting entities in the Middle East and Africa.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Top 10 Best Ways To Secure Your Computer from Cyber Attacks

Most Difficult Security Challenges for CxO (Chief x Officers) During the Cyber Attack

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

CISA to Stop Publishing Cybersecurity Alerts and Advisories on Webpages

Cybersecurity and Infrastructure Security Agency (CISA) has announced significant changes to how it communicates...

Pwn2Own Day 3: Zero-Day Exploits Windows 11, VMware ESXi, and Firefox

The Pwn2Own Berlin 2025 last day ended with impressive technological accomplishments, bringing the total...

GNU C(glibc) Vulnerability Let Attackers Execute Arbitrary Code on Millions of Linux Systems

Security researchers have disclosed a significant vulnerability in the GNU C Library (glibc), potentially...

Exploiting dMSA for Advanced Active Directory Persistence

Security researchers have identified new methods for achieving persistence in Active Directory environments by...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Pwn2Own Day 3: Zero-Day Exploits Windows 11, VMware ESXi, and Firefox

The Pwn2Own Berlin 2025 last day ended with impressive technological accomplishments, bringing the total...

GNU C(glibc) Vulnerability Let Attackers Execute Arbitrary Code on Millions of Linux Systems

Security researchers have disclosed a significant vulnerability in the GNU C Library (glibc), potentially...

VMware ESXi, Firefox, Red Hat Linux & SharePoint Hacked – Pwn2Own Day 2

Security researchers demonstrated their prowess on the second day of Pwn2Own Berlin 2025, discovering...