The Cybersecurity and Infrastructure Security Agency (CISA) has formally warned that ransomware gangs are actively exploiting a critical vulnerability in Microsoft Defender, urging immediate action to patch the flaw.
The vulnerability, tracked as CVE-2024-21338 and dubbed "BlueHammer," allows a local attacker to gain kernel-level privileges on Windows systems. In a significant development first reported by BleepingComputer, CISA confirmed on Monday that it has added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, indicating widespread exploitation by ransomware operators.
Previously, the vulnerability was known to be abused in limited, targeted zero-day attacks. Its new role in ransomware campaigns marks a dangerous escalation. Attackers are now leveraging the vulnerability as a reliable tool for privilege escalation, a crucial step before deploying ransomware payloads across a network.
The flaw resides within the Microsoft Defender Anti-Virus driver itself—the core component responsible for system protection. This creates a critical irony: the very software designed to secure a system becomes the gateway for its compromise. A successful exploit grants an attacker full SYSTEM-level control, allowing them to disable defenses, move laterally, and execute the final stages of a ransomware attack.
The incident highlights a ruthless efficiency in the cybercriminal ecosystem. Once Microsoft issued a patch for the vulnerability, the technical details became public. Threat actors rapidly reverse-engineered the fix to create exploits, specifically targeting organizations that had not yet applied the security update. This "patch-to-exploit" cycle transforms delayed remediation into an immediate, high-severity risk.
For defenders, this case is a stark reminder. It dismantles the notion that any single security layer, especially endpoint protection, is infallible. The attack underscores the absolute necessity of two foundational practices:
- Prioritized Patching: Security software updates must be treated with the same urgency as critical operating system patches, as they are a primary attack surface.
- Defense-in-Depth: Organizations cannot rely solely on antivirus agents. A robust strategy requires continuous monitoring of endpoints, network traffic, and user behavior to detect the anomalies indicative of privilege escalation attempts.
CISA has issued a binding operational directive for Federal Civilian Executive Branch agencies to remediate this and other known exploited vulnerabilities by a specified deadline. While the directive applies to federal bodies, the advisory is a clear warning for all organizations. The definitive mitigation is to apply the latest Microsoft Defender updates immediately, which completely eliminates the BlueHammer attack vector.
美國網絡安全及基礎設施安全局（CISA）已正式發出警告，指勒索軟件組織正積極利用微軟Defender一個嚴重漏洞，敦促各界立即採取行動應用修補程式。
該漏洞被編為CVE-2024-21338，並暱稱為「BlueHammer」，容許本地攻擊者在Windows系統上取得核心級權限。CISA周一證實已將該漏洞納入其「已知遭利用漏洞」目錄——這項重要進展首先由BleepingComputer報導——顯示勒索軟件操作者正廣泛利用此漏洞。
此前，該漏洞已知僅在有限的針對性零日攻擊中被濫用。其在勒索軟件活動中的新角色標誌著危險的升級。攻擊者現正將此漏洞作為權限提升的可靠工具，這是在網絡中部署勒索軟件載荷前的關鍵步驟。
該缺陷存在於微軟Defender防病毒驅動程式本身——負責系統防護的核心組件。這創造了一個關鍵的諷刺：原本用於保障系統安全的軟件，反而成為導致系統失陷的缺口。成功利用漏洞可賦予攻擊者完整的系統級控制權，使其能禁用防禦措施、橫向移動並執行勒索軟件攻擊的最終階段。
此次事件凸顯了網絡犯罪生態系的冷酷效率。微軟發出該漏洞的修補程式後，技術細節隨即公開。威脅行為者迅速對修補程式進行逆向工程以創建漏洞利用工具，特別針對尚未應用安全更新的組織。這種「修補至利用」的週期，將延遲補救轉化為即時的高風險威脅。
對防禦方而言，此案例是嚴峻提醒。它粉碎了任何單一安全層級——尤其是端點防護——無懈可擊的觀念。此次攻擊強調兩項基本措施的絕對必要性：
- 優先處理修補程式： 安全軟件更新必須與關鍵操作系統修補程式同等緊急處理，因其已成為主要攻擊面。
- 縱深防禦： 組織不應僅依賴防病毒代理程式。穩健的策略需持續監控端點、網絡流量及用戶行為，以偵測指示權限提升企圖的異常活動。
CISA已向聯邦民事行政分支機構發出約束性操作指令，要求其在指定期限內修補此漏洞及其他已知遭利用漏洞。儘管指令適用於聯邦機構，此公告對所有組織均是明確警告。決定性的緩解措施是立即應用最新的微軟Defender更新，以完全消除BlueHammer攻擊向量。