BlueKeep is now being exploited
The Remote Desktop bug from May is being used to install crypto miners. Unpatched machines are also crashing.
Researchers confirmed at the weekend the first mass exploitation of BlueKeep, the Remote Desktop bug Microsoft patched in May. Attackers are scanning for exposed Windows machines and installing a cryptocurrency miner. The exploit is unreliable, so many machines simply crash with a blue screen.
It isn’t the fast-spreading worm people feared. Not yet. But the exploit is public now, and it will get better.
If you skipped it in May:
- Patch Windows 7 and Server 2008 machines today.
- Close RDP to the internet, and put it behind a VPN or gateway.
- Investigate unexplained crashes on machines with RDP open. They might be failed attacks.
Six months of warnings, and many machines are still exposed. Patching critical bugs within days, not months, needs to be a normal process, not a heroic effort.