Microsoft has launched patches to repair 67 safety flaws, together with one zero-day bug in Net Distributed Authoring and Versioning (WEBDAV) that it stated has come below energetic exploitation within the wild.
Of the 67 vulnerabilities, 11 are rated Crucial and 56 are rated Necessary in severity. This contains 26 distant code execution flaws, 17 data disclosure flaws, and 14 privilege escalation flaws.
The patches are along with 13 shortcomings addressed by the corporate in its Chromium-based Edge browser because the launch of final month’s Patch Tuesday replace.
The vulnerability that has been weaponized in real-world assaults considerations a distant code execution in WEBDAV (CVE-2025-33053, CVSS rating: 8.8) that may be triggered by deceiving customers into clicking on a specifically crafted URL.
The tech large credited Verify Level researchers Alexandra Gofman and David Driker for locating and reporting the bug. It is price mentioning that CVE-2025-33053 is the primary zero-day vulnerability to be disclosed within the WebDAV customary.
In a separate report, the cybersecurity firm attributed the abuse of CVE-2025-33053 to a risk actor generally known as Stealth Falcon (aka FruityArmor), which has a historical past of leveraging Home windows zero-days in its assaults. In September 2023, the hacking group was noticed utilizing a backdoor dubbed Deadglyph as a part of an espionage marketing campaign aimed toward entities in Qatar and Saudi Arabia.
“The assault used a .url file that exploited a zero-day vulnerability (CVE-2025-33053) to execute malware from an actor-controlled WebDAV server,” Verify Level stated. “CVE-2025-33053 permits distant code execution by manipulation of the working listing.”
Within the assault chain noticed towards an unnamed protection firm in Turkey, the risk actor is claimed to have employed CVE-2025-33053 to ship Horus Agent, a {custom} implant constructed for the Mythic command-and-control (C2) framework. It is believed that the malicious payload used to provoke the assault, a URL shortcut file, was despatched as an archived attachment in a phishing electronic mail.
The URL file is used to launch iediagcmd.exe, a official diagnostics utility for Web Explorer, leveraging it to launch one other payload known as Horus Loader, which is accountable for serving a decoy PDF doc and executing Horus Agent.
“Written in C++, the implant reveals no important overlap with recognized C-based Mythic brokers, apart from commonalities within the generic logic associated to Mythic C2 communications,” Verify Level stated. “Whereas the loader makes positive to implement some measures to guard the payload, the risk actors positioned further precautions inside the backdoor itself.”
This contains the usage of methods like string encryption and management stream flattening to complicate evaluation efforts. The backdoor then connects to a distant server to fetch duties that permit it to gather system data, enumerate information and folders, obtain information from the server, inject shellcode into working processes, and exit this system.
Horus Agent is assessed to be an evolution of the personalized Apollo implant, an open-source .NET agent for Mythic framework, that was beforehand put to make use of by Stealth Falcon between 2022 and 2023.
“Horus is a extra superior model of the risk teams’ {custom} Apollo implant, rewritten in C++, improved, and refactored,” Verify Level stated.
“Just like the Horus model, the Apollo model introduces intensive sufferer fingerprinting capabilities whereas limiting the variety of supported instructions. This permits the risk actors to deal with stealthy identification of the contaminated machine and subsequent stage payload supply, whereas additionally conserving the implant measurement considerably smaller (solely 120Kb) than the total agent.”
The corporate stated it additionally noticed the risk actor leveraging a number of beforehand undocumented instruments equivalent to the next –
Credential Dumper, which targets an already-compromised Area Controller to steal Lively Listing and Area Controller credential-related information
Passive backdoor, which listens for incoming requests and executes shellcode payloads
Keylogger, a {custom} C++ device that data all keystrokes and writes them to a file below “C:/home windows/temp/~TNpercentLogName%.tmp”
The keylogger notably lacks any C2 mechanism, that means that it doubtless works along side one other part that may exfiltrate the file to the attackers.
“Stealth Falcon employs industrial code obfuscation and safety instruments, in addition to custom-modified variations tailor-made for various payload sorts,” the Verify Level stated. “This makes their instruments tougher to reverse-engineer and complicates monitoring technical modifications over time.”
The energetic exploitation of CVE-2025-33053 has prompted the U.S. Cybersecurity and Infrastructure Safety Company (CISA) so as to add it to the Recognized Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Govt Department (FCEB) companies to use the repair by July 1, 2025.
“What makes this flaw notably regarding is the widespread use of WebDAV in enterprise environments for distant file sharing and collaboration,” Mike Walters, President and Co-Founding father of Action1, stated. “Many organizations allow WebDAV for official enterprise wants — usually with out totally understanding the safety dangers it introduces.”
Essentially the most extreme vulnerability resolved by Microsoft is a privilege escalation flaw in Energy Automate (CVE-2025-47966, CVSS rating: 9.8) that would allow an attacker to raise privileges over a community. Nevertheless, there is no such thing as a buyer motion required to mitigate the bug.
Different vulnerabilities of observe embody elevation of privilege flaws in Widespread Log File System Driver (CVE-2025-32713, CVSS rating: 7.8), Home windows Netlogon (CVE-2025-33070, CVSS rating: 8.1), and Home windows SMB Consumer (CVE-2025-33073, CVSS rating: 8.8), in addition to a crucial unauthenticated RCE vulnerability within the Home windows KDC Proxy Service (CVE-2025-33071, CVSS rating: 8.1).
“Over the previous a number of months, the CLFS driver has turn into a constant focus for each risk actors and safety researchers as a result of its exploitation in a number of ransomware operations,” Ben McCarthy, lead cyber safety engineer at Immersive stated.
“It’s categorized as a heap-based buffer overflow — a kind of reminiscence corruption vulnerability. The assault complexity is taken into account low, and profitable exploitation permits an attacker to escalate privileges.”
Adam Barnett, lead software program engineer at Rapid7, stated the exploitation of CVE-2025-33071 requires the attacker to use a cryptographic flaw and win a race situation.
“The dangerous information is that Microsoft considers exploitation extra doubtless regardless, and since a KDC proxy helps Kerberos requests from untrusted networks extra simply entry trusted belongings with none want for a direct TCP connection from the shopper to the area controller, the trade-off right here is that the KDC proxy itself is sort of prone to be uncovered to an untrusted community,” Barnett added.
Final however not least, Microsoft has additionally rolled out patches to remediate a safe boot bypass bug (CVE-2025-3052, CVSS rating: 6.7) found by Binarly that permits the execution of untrusted software program.
“A vulnerability exists in a UEFI software signed with a Microsoft third-party UEFI certificates, which permits an attacker to bypass UEFI Safe Boot,” Redmond stated in an alert. “An attacker who efficiently exploited this vulnerability may bypass Safe Boot.”
CERT Coordination Middle (CERT/CC), in an advisory launched Tuesday, stated the vulnerability is rooted in Unified Extensible Firmware Interface (UEFI) functions DTBios and BiosFlashShell from DT Analysis, permitting Safe Boot bypass utilizing a specifically crafted NVRAM variable.
“The vulnerability stems from improper dealing with of a runtime NVRAM variable that permits an arbitrary write primitive, able to modifying crucial firmware buildings, together with the worldwide Security2 Architectural Protocol used for Safe Boot verification,” CERT/CC stated.
“As a result of the affected functions are signed by the Microsoft UEFI Certificates Authority, this vulnerability might be exploited on any UEFI-compliant system, permitting unsigned code to run in the course of the boot course of.”
Profitable exploitation of the vulnerability may allow the execution of unsigned or malicious code even earlier than the working system masses, doubtlessly enabling attackers to drop persistent malware that may survive reboots and even disable safety software program.
Microsoft, nevertheless, shouldn’t be affected by CVE-2025-4275 (aka Hydroph0bia), one other Safe Boot bypass vulnerability current in an Insyde H2O UEFI software that enables digital certificates injection by an unprotected NVRAM variable (“SecureFlashCertData”), leading to arbitrary code execution on the firmware stage.
“This situation arises from the unsafe use of an NVRAM variable, which is used as trusted storage for a digital certificates within the belief validation chain,” CERT/CC stated. “An attacker can retailer their very own certificates on this variable and subsequently run arbitrary firmware (signed by the injected certificates) in the course of the early boot course of inside the UEFI atmosphere.”
Discovered this text attention-grabbing? Comply with us on Twitter and LinkedIn to learn extra unique content material we put up.
