Malware attacks exploiting app installation protocol prompt deactivation

Several threat operations including Sangria Tempest or FIN7, Storm-0569, Storm-1674, and Storm-1113 have exploited Microsoft's "ms-appinstaller protocol" for expediting Windows app installation to facilitate malware distribution, resulting in the deactivation of the protocol, reports The Record, a news site by cybersecurity firm Recorded Future.

app attacks cybersecurity deactivation distribution exploited exploiting fin7 future installation malware malware attacks malware distribution microsoft ms-appinstaller operations prompt protocol record recorded future reports storm tempest the record threat threat intelligence threat operations windows