Nokoyawa ransomware attacks with Windows zero-day

In February 2023, Kaspersky technologies detected a number of attempts to execute similar elevation-of-privilege exploits on Microsoft Windows servers belonging to small and medium-sized businesses in the Middle East, in North America, and previously in Asia regions. These exploits were very similar to already known Common Log File System (CLFS) driver exploits that we analyzed previously, but we decided to double check and it was worth it – one of the exploits turned out to be a zero-day, supporting different …

america asia attacks businesses check clfs driver exploit exploits february file file system kaspersky log medium microsoft microsoft windows middle east nokoyawa nokoyawa ransomware north north america obfuscated privilege ransomware ransomware attacks servers system technologies windows windows 11 zero-day