Threat Source Newsletter (Dec. 2, 2021)
Summary: Cisco Talos reported that a Windows Installer elevation-of-privilege vulnerability affecting every version of Microsoft Windows, including fully patched Windows 11 and Server 2022, was not fully remediated by Microsoft's Nov. 9 patch for CVE-2021-41379, and researcher Abdelhamid Naceri published working proof-of-concept exploit code on GitHub on Nov. 22. Talos also reported that Emotet, disrupted by an international takedown in early 2021, has re-emerged and is rebuilding the infrastructure and distribution needed to reconstitute its botnets.
Key Takeaway: Talos says it has already detected malware samples in the wild attempting to exploit the Windows Installer flaw, and the public exploit lets a limited user account run code as an administrator on fully patched systems. Emotet's return gives threat actors the same initial foothold that historically led to follow-on malware infections, even at lower volumes than before.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-41379
- Related
- CVE-2021-41379: Microsoft Windows Installer Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022Attackers exploiting zero-day vulnerability in Windows Installer — Here’s what you need to know and Talos’ coverage Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026