Microsoft: BlueKeep Exploit Will Likely Deliver More Damaging Payloads

After news broke that cybercriminals have started leveraging the BlueKeep vulnerability to deliver cryptocurrency miners, Microsoft has warned that the exploit will likely also be used to deliver more “impactful and damaging” payloads.

While there is no evidence that BlueKeep has been exploited to distribute ransomware or other types of malware, Microsoft believes it’s only a matter of time before it happens.

The assaults, first detailed several days ago, were attempting to deliver cryptocurrency mining malware by exploiting a vulnerability in the Windows Remote Desktop Services (RDS) tracked as CVE-2019-0708, but better known as BlueKeep.

Microsoft initially released a security patch for the vulnerability on May 14, 2019, but that did not stop cybercriminals from targeting it, especially with hundreds of thousands of systems remaining unpatched months after the fix was published.

Kevin Beaumont, the security researcher who named the security flaw, says recent attacks on his honeypots, which started on October 23, were targeting BlueKeep in an attempt to drop a Monero miner.

An analysis performed together with British researcher Marcus Hutchins (aka MalwareTech) has revealed that a BlueKeep Metasploit module that was released in September is being leveraged as part of these new attacks.

According to Microsoft, however, some users have had protection from this wave of assaults since early September, when a behavioral detection for the Metasploit module was rolled out to Microsoft Defender ATP customers.

The BlueKeep Metasploit module appears unstable, causing numerous RDP-related crashes, and Microsoft used this information to track the attacks on vulnerable machines.

Thus, it observed an increase in the number of RDP service crashes from 10 to 100 daily, starting on September 6 (when the module was released), an increase in memory corruption crashes starting on October 9, and crashes on external researcher honeypots starting on October 23.

The collected data revealed evidence that the same attacker likely conducted another campaign aimed at delivering a coin miner in September. The implant in the first campaign contacted the same command and control (C&C) infrastructure — hosted in Israel — used in the recent operation.

Vulnerable machines in France, Russia, Italy, Spain, Ukraine, Germany, the United Kingdom, and many other countries were eventually infected as part of these assaults, the tech giant reveals.

According to Microsoft, the attacks likely started as port scans for machines with vulnerable internet-facing RDP services, but ended up leveraging the BlueKeep Metasploit module to run PowerShell scripts and deliver miners onto the compromised systems.

“The new exploit attacks show that BlueKeep will be a threat as long as systems remain unpatched, credential hygiene is not achieved, and overall security posture is not kept in check. Customers are encouraged to identify and update vulnerable systems immediately,” Microsoft notes.

Related: BlueKeep Vulnerability Exploited to Deliver Cryptocurrency Miner

Related: BlueKeep Exploit Added to Metasploit