Loading story…
Check Point Research said a prolific exploit developer tracked as Volodya supplied Windows kernel local privilege escalation (LPE) code that appeared in both financially motivated malware and state-linked intrusion sets. By analyzing coding fingerprints in exploit modules, researchers tied more than 10 Windows LPE exploits to the same author, including at least five believed to have been used as zero-days between 2015 and 2019. The attribution began with a CVE-2019-0859 exploit recovered during incident response and expanded through recurring implementation traits such as a reusable elevate(target_pid) API, use of HMValidateHandle for kernel leaks, and token-stealing techniques based on scanning PsList with arbitrary read/write primitives.
Get the actors, campaigns, and ATT&CK mapping behind it.
12 events from the most recent confirmed update back to the earliest known activity.
Check Point published research attributing more than 10 Windows kernel local privilege escalation exploits to the developer Volodya using code fingerprinting. The report concluded that Volodya sold exploit modules to both crimeware and APT customers and documented recurring implementation traits across exploits from 2015 to 2019.
Check Point reported that CVE-2019-1458 was found in malware attributed to Operation WizardOpium, although its sample did not match the in-the-wild zero-day exploit described by Kaspersky. The exploit was still included in the set attributed to Volodya.
Check Point said CVE-2019-1132 was attributed to Buhtrap based on matching technical details and a PDB path containing volodimir_65, and assessed it as likely a Volodya zero-day. The researchers had not found the sample themselves.
Check Point's research began from an incident response case involving a small 64-bit executable used by malware to exploit CVE-2019-0859 on a victim machine. The sample included a leftover PDB path referencing cve-2019-0859, indicating real-world exploitation rather than a public proof of concept.
Check Point reported that CVE-2018-8641 was found in Magniber samples and noted that Kaspersky independently attributed the exploit to Volodya. The content anchors this event to 2018 only.
Check Point assessed CVE-2017-0263 as a zero-day used by APT28 and attributed the exploit's development to Volodya. The content provides only the year for this event.
Check Point reported that CVE-2017-0001 was used as a one-day in operations attributed to Turla and was later reused by Ursnif. The exploit was attributed to Volodya through fingerprinting.
FireEye published research on a threat actor leveraging a Windows zero-day exploit in payment card data attacks. Check Point later assessed CVE-2016-0167 as one of the zero-days attributable to Volodya.
Check Point said CVE-2016-7255 was attributable to APT28 and was later used by Ursnif, Dreambot, GandCrab, Cerber, and Maze. The exploit was also assessed as one of Volodya's zero-days.
Check Point attributed CVE-2016-0040 and CVE-2016-0165 to Volodya in its retrospective clustering of exploit samples. No more precise date is given in the content beyond the year.
Check Point later attributed CVE-2015-2546 to the exploit developer Volodya as part of a broader cluster of Windows kernel local privilege escalation exploits. The content anchors this event only to the year implied by the CVE identifier and attribution list.
Kaspersky previously reported that BuggiCorp, later identified as Volodya, advertised a Windows zero-day for sale on the Exploit[.]in forum with a starting price of $95,000. The reference does not provide a specific date for the advertisement.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
research.checkpoint.com
Open sourcefireeye.com
Open sourcefireeye.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research identified an exploit developer known as **PlayBit** (also tracked as `luxor2008`) as the likely author of multiple Windows local privilege escalation 1-day exploits, linking the actor to code for `CVE-2013-3660`, `CVE-2015-0057`, `CVE-2015-1701`, `CVE-2016-7255`, and `CVE-2018-8453`. The attribution was based on recurring coding patterns across samples, including hash-based API imports, detailed OS and patch-state checks, kernel pointer leaks through Desktop Heap metadata, and evolving `SMEP`/`NX` bypass methods. Researchers said the exploits were marketed commercially, with broad Windows-version support and pricing reportedly in the **$5,000 to $10,000** range. The same exploit lineage was later tied to real-world attacks by both crimeware and targeted operators. The referenced vulnerabilities were used by malware families including **Dyre, Ramnit, Locky, LockCrypt, Maze, REvil, and Sodin**, while `CVE-2018-8453` was also reported in targeted attacks. The reporting indicates that PlayBit’s tooling and exploit-development tradecraft became a shared enabler for post-compromise privilege escalation, helping ransomware and other malware operators turn initial access into full system control.
Aug 15, 2026
Elastic Security Labs disclosed two Windows zero-day exploit paths that enable attackers with local administrator privileges to bypass Protected Process Light (PPL) protections and escalate from PPL to kernel-level execution. The `PPLFault` and `GodFault` techniques can disable Windows Defender and other AV/EDR controls without a bring-your-own-vulnerable-driver (BYOVD) component, undermining controls intended to restrict administrator-driven kernel tampering. The techniques operate despite Windows defenses including Driver Signing Enforcement, Secure Boot, and the Vulnerable Driver Blocklist, which limit untrusted kernel drivers but do not prevent this driverless exploit chain. Microsoft reportedly declined to patch the issues because exploitation requires administrator access; Elastic released the NoFault kernel driver as an interim PPL mitigation and integrated protection into Elastic Endpoint/Defend version 8.9.0 and later, while the underlying kernel escalation remained unpatched.
Aug 26, 2026
Kaspersky Lab disclosed that attackers exploited a Windows zero-day later assigned **`CVE-2018-8589`**, a race condition in **`win32k.sys`** tied to **`win32k!xxxMoveWindow`**, before Microsoft issued a patch in its security bulletin. The exploit was detected in the wild after Kaspersky's Automatic Exploit Prevention flagged activity in October 2018, indicating active abuse rather than a purely theoretical flaw. The exploit was used by the first stage of a malware installer to gain elevated privileges and establish persistence on compromised systems. Kaspersky said the observed campaign was limited in scope, with known victims located in the Middle East, and that the in-the-wild exploit specifically targeted **32-bit Windows 7** systems.
Aug 14, 2026