Windows Defender 'BlueHammer' vulnerability now exploited as part of malware campaigns — CISA issues warning despite patch release on April 14

Update reminder — (Image credit: Getty Images)

Late spring and early summer in the cybersecurity world were marked by multiple Windows exploits, thanks to the efforts of the controversial hacker figure Nightmare Eclipse. One of the better-known exploits is BlueHammer, a race condition in Windows Defender that gets you a shell with access to the SYSTEM user with just a small script — in other words, the keys to the kingdom in exchange for a double-click. Microsoft released a patch on April 14, but as a clear illustration of the lack of cybersecurity awareness, CISA (the U.S. cyber-defense agency) yesterday marked BlueHammer as actively exploited in ransomware campaigns.

That marks about a month and a half since the patch, and it illustrates quite clearly that when it comes to computer security, the publication of a patch is almost always the easy part; getting that patch into every device that needs it is the real tricky bit. The patch is part of standard Windows updates, too, so there's really no technical reason for not installing it. Additionally, since BlueHammer gets the attackers a SYSTEM shell, the ransomware in question may encrypt parts of the OS or the boot process rather than "just" the data files, potentially making machines unusable on top.

While stating that "people don't patch their machines" is a broad statement that won't surprise anyone in the field, a recent report from security vendor Absolute claims the application of critical OS patches across Windows 11 and 10 lags 127 days (over 4 months) on average, and that figure basically doubled since last year. Even in enterprise settings, Absolute says the average time-to-patch is shockingly high at 76 days, or 2.5 months. While one vendor's claims aren't gospel, the figures aren't too hard to believe; plus, they're averages, meaning half the machines purportedly go unpatched for longer than those timeframes.

Latest Videos From

Watch full video here:

Depending on the source, estimates on the percentage of Windows 10 machines can vary between 15% (PassMark) and 26% (StatCounter). Calling it 20% for simplicity's sake, that's 1 out of 5 machines almost guaranteed to be unpatched. Techies like us know full well that Microsoft has extended security updates (ESU) for Windows 10 twice now, with the new real EOL now being October 14, 2027. The problem is, although enrolling a machine into ESU is trivial, the lack of public awareness essentially guarantees these machines will remain vulnerable until they're upgraded or replaced.

Meanwhile, Nightmare Eclipse says they're "done with taking a break", and that "July will be an incredibly interesting month because [they] will drop some really interesting and possibly insanely controversial findings."

Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.

Bruno Ferreira is a contributing writer for Tom's Hardware. He has decades of experience with PC hardware and assorted sundries, alongside a career as a developer. He's obsessed with detail and has a tendency to ramble on the topics he loves. When not doing that, he's usually playing games, or at live music shows and festivals.

4 Comments Comment from the forums

ezst036

Linux was vulnerable last month. Who will it be in July or August.
Reply
bit_user

The article said:
they're averages, meaning half the machines purportedly go unpatched for longer than those timeframes.
That's true of a median, but not necessarily a mean (which is the more common type of average).

Even with a mean, some machines will go unpatched for longer, but it's not usually a 50/50 split - especially in cases where the distribution is asymmetrical, which should be the case here.
Reply
DS426

ezst036 said:
Linux was vulnerable last month. Who will it be in July or August.
Windows -- almost certainly based on Nightmare Eclipse's own claims. Linux might be as well due to the use of recent AI models to both find software vulnerabilities and craft exploits for them.
Reply
DS426

Crazy that time-to-patch is increasing when newer advances in patching like Autopatch and Hotpatching are available in the Windows world. A 30-day TTP is too long on Windows in a business environment, about 7 days being the gold standard and 14 being silver. Sysadmins do have to test on various client and server hardware and software combinations and roll out gradually ("update rings"), which takes several days for most medium to large organizations.

Rather high numbers in this article for TTP; I think Absolute is using data on consumer PC's as well, some of which are ones where someone paused updates and thus are kind of skewing the numbers as @bit_user mentioned can happen with both mean and median averages ("outliers"). I'm seeing numbers in the single-digits to teens for a good portion of enterprises from various reporting sources on the Windows OS, though apps do have higher numbers.

Still, yes, millions of Windows PC's remain vulnerable to actively-exploited OS and/or app vulns for over a month. That reality isn't going away any time soon.

Edit: looking into this more, this article is missing some important context. It reads:

Microsoft released a patch on April 14, but as a clear illustration of the lack of cybersecurity awareness, CISA (the U.S. cyber-defense agency) yesterday marked BlueHammer as actively exploited in ransomware campaigns.
CISA added BlueHammer to the KEV on April 22nd, then updated the 'Used In Ransomware Attacks?' flag on that KEV page to 'yes' this past Monday June 29th. BlueHammer was actually exploited as a zero-day as reported by Huntress Labs threat researchers -- first exploited on April 10th, four days before MS released the patch, hence it becoming an actively-exploited zero-day. So, even the best TTP in the world wouldn't have protected those endpoints from being exploited using BlueHammer.

The bigger/more relevant security narrative IMO going on here is Nightmare Eclipse releasing zero-days on or after Patch Tuesday and Microsoft's continued failure to resolve the dispute. Not that TTP isn't a serious global security issue because it is, but I found it detracting. That's me though, take it FWIW at free-ninety-nine. ;)

https://www.huntress.com/blog/nightmare-eclipse-intrusion(Article was published on 20 April but they mention about half-way down about the 10 April observance of BlueHammer in the wild).
Reply