Security Experts:

Connect with us

Hi, what are you looking for?


Malware & Threats

Microsoft: BlueKeep Exploit Will Likely Deliver More Damaging Payloads

After news broke that cybercriminals have started leveraging the BlueKeep vulnerability to deliver cryptocurrency miners, Microsoft has warned that the exploit will likely also be used to deliver more “impactful and damaging” payloads.

After news broke that cybercriminals have started leveraging the BlueKeep vulnerability to deliver cryptocurrency miners, Microsoft has warned that the exploit will likely also be used to deliver more “impactful and damaging” payloads.

While there is no evidence that BlueKeep has been exploited to distribute ransomware or other types of malware, Microsoft believes it’s only a matter of time before it happens.

The assaults, first detailed several days ago, were attempting to deliver cryptocurrency mining malware by exploiting a vulnerability in the Windows Remote Desktop Services (RDS) tracked as CVE-2019-0708, but better known as BlueKeep.

Microsoft initially released a security patch for the vulnerability on May 14, 2019, but that did not stop cybercriminals from targeting it, especially with hundreds of thousands of systems remaining unpatched months after the fix was published.

Kevin Beaumont, the security researcher who named the security flaw, says recent attacks on his honeypots, which started on October 23, were targeting BlueKeep in an attempt to drop a Monero miner.

An analysis performed together with British researcher Marcus Hutchins (aka MalwareTech) has revealed that a BlueKeep Metasploit module that was released in September is being leveraged as part of these new attacks.

According to Microsoft, however, some users have had protection from this wave of assaults since early September, when a behavioral detection for the Metasploit module was rolled out to Microsoft Defender ATP customers.

The BlueKeep Metasploit module appears unstable, causing numerous RDP-related crashes, and Microsoft used this information to track the attacks on vulnerable machines.

Thus, it observed an increase in the number of RDP service crashes from 10 to 100 daily, starting on September 6 (when the module was released), an increase in memory corruption crashes starting on October 9, and crashes on external researcher honeypots starting on October 23.

The collected data revealed evidence that the same attacker likely conducted another campaign aimed at delivering a coin miner in September. The implant in the first campaign contacted the same command and control (C&C) infrastructure — hosted in Israel — used in the recent operation.

Vulnerable machines in France, Russia, Italy, Spain, Ukraine, Germany, the United Kingdom, and many other countries were eventually infected as part of these assaults, the tech giant reveals.

According to Microsoft, the attacks likely started as port scans for machines with vulnerable internet-facing RDP services, but ended up leveraging the BlueKeep Metasploit module to run PowerShell scripts and deliver miners onto the compromised systems.

“The new exploit attacks show that BlueKeep will be a threat as long as systems remain unpatched, credential hygiene is not achieved, and overall security posture is not kept in check. Customers are encouraged to identify and update vulnerable systems immediately,” Microsoft notes.

Related: BlueKeep Vulnerability Exploited to Deliver Cryptocurrency Miner

Related: BlueKeep Exploit Added to Metasploit

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.


Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.


Several vulnerabilities have been patched in OpenText’s enterprise content management (ECM) product.