vulnerabilities CVE-2023-28252 zero-day vulnerability in CLFS Kaspersky experts discover a CLFS vulnerability being exploited by cybercriminals. Editorial Team April 11, 2023 Thanks to their Behavioral Detection Engine and Exploit Prevention components, our solutions have detected attempts to exploit a previously unknown vulnerability in the Common Log File System (CLFS) — the logging subsystem of Windows operating systems. After thoroughly investigating the exploit, our Global Research & Analysis Team (GReAT) contacted Microsoft and provided all their findings. The developers designated the vulnerability as CVE-2023-28252, and closed it on April 4, 2023 with the April Patch Tuesday update. We advise installing the fresh patches as soon as possible, because the vulnerability isn’t just being exploited by attackers — it’s being used in ransomware attacks. What is the CVE-2023-28252 vulnerability? CVE-2023-28252 belongs to the class of privilege-elevation vulnerabilities. To exploit it, attackers must manipulate a BLF file to elevate their privileges in the system and be able to continue their attack (so they need initial access with user privileges). As usual, our Securelist website has the technical info, plus indicators of compromise, but the details aren’t being disclosed just now since they could be used by other cybercriminals to carry out new attacks. However, our experts intend to share them on April 20 (or thereabouts), by which date most users will have installed the patches. What is the CVE-2023-28252 vulnerability used for? Unlike most zero-day vulnerabilities, CVE-2023-28252 isn’t being used in APT attacks. In this case, the final payload delivered to victims’ computers was a new variant of the Nokoyawa ransomware. But after examining the exploit, our experts concluded that the attackers behind it were also responsible for creating a number of earlier, similar exploits for vulnerabilities in that same CLFS. In attacks deploying those we’ve seen other tools too, including Cobalt Strike Beacon and the modular backdoor Pipemagic. How to stay safe First of all, we recommend installing the April updates for Windows. In general, to secure your infrastructure against attacks using vulnerabilities (both known and zero-day), you need to protect all work computers and servers with reliable security solutions featuring protection against vulnerability exploitation. Our products automatically detect attempts to attack through CVE-2023-28252 as well as all malware used by the cybercriminals who created the exploit.
Read next Turbocharge your VPN How to set up modern VPN services to significantly speed up the connection and access new content securely.
Tips How to improve your resume with AI without exposing your data Let’s look at how to use AI as a resume editor without oversharing to build a document that gets past automated screening systems and catches a recruiter’s eye.
Tips How can students overcome the fear of unfulfilled potential, and where does cybersecurity come into it? University students sometimes don’t see the practical value of what they’re studying, and aren’t always sure what to do next. Kaspersky Academy’s free “Cybersecurity. Entry Level” course can help them pick up in-demand skills directly from Kaspersky experts.
Tips Nine reasons to set up a VPN on your router Get the most speed, reliability, and convenience out of your VPN by putting it on your router. Here’s a look at the real benefits of specific VPN setup scenarios for your whole home network.
Tips Fact and fiction about hidden Wi-Fi network names Hiding your Wi-Fi network name might seem like a smart security move, but in practice it does more harm than good. Let’s take a look at how it works, what side effects it can have, and how to properly secure your home Wi-Fi.