Loading story…
Kaspersky reported a highly targeted attack campaign in which a previously unidentified threat actor dubbed PuzzleMaker chained a Google Chrome remote code execution exploit with two Microsoft Windows kernel zero-days to break out of the browser sandbox and obtain SYSTEM privileges on victim machines. The Windows flaws were identified as CVE-2021-31955, an information disclosure issue in ntoskrnl.exe that exposed EPROCESS kernel addresses through SuperFetch, and CVE-2021-31956, a heap-based buffer overflow in ntfs.sys; Microsoft later patched both vulnerabilities.
Investigators said the intrusions were detected during April 14-15 and likely relied on a Chrome exploit related to CVE-2021-21224 rather than CVE-2021-21220, because some victims had already updated their browsers before the attacks. The post-exploitation chain deployed a stager, dropper, service component, and a remote shell payload disguised as Windows files, while command-and-control infrastructure included media-seoengine[.]com. Kaspersky said it found no strong ties to previously tracked groups, although the attackers used the publicly known PreviousMode technique during exploitation.
Get the actors, campaigns, and ATT&CK mapping behind it.
7 events from the most recent confirmed update back to the earliest known activity.
Microsoft patched the two Windows kernel zero-days used in the chain during Patch Tuesday. The flaws were CVE-2021-31955, an information disclosure issue in ntoskrnl.exe, and CVE-2021-31956, a heap-based buffer overflow in ntfs.sys.
Google fixed the Chrome vulnerability associated with V8 issue 1195777 and tracked it as CVE-2021-21224. Kaspersky assessed this flaw was the likely browser component used in the observed exploit chain.
A public Chrome exploit using V8 issue 1195777 was published and was reported to work against Chrome 90.0.4430.72. Kaspersky cited this as support for its suspicion that the in-the-wild chain likely used the flaw later tracked as CVE-2021-21224.
Google released Chrome 90.0.4430.72 with fixes for 37 vulnerabilities. The same source notes a public exploit published that day using V8 issue 1195777 worked against this version.
Kaspersky detected a wave of highly targeted attacks against multiple companies that used a Chrome remote code execution exploit chained with two Windows kernel zero-days to escape the sandbox and gain SYSTEM privileges.
Google released Chrome 89.0.4389.128 with fixes including CVE-2021-21220. Kaspersky later noted some victims had already installed this version before being attacked, suggesting that flaw was probably not used in the campaign.
Kaspersky published its analysis of the exploit chain, post-exploitation malware, and infrastructure including media-seoengine[.]com. It attributed the activity to a previously unidentified threat actor it named PuzzleMaker.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released a **Stable Channel Update for Desktop** to fix `CVE-2025-2783`, a critical Chrome zero-day affecting Windows that allows a **sandbox escape** through a logical error at the browser and operating system interface. The flaw is in Chrome's **Mojo** component, carries a `CVSS 9.8` rating, and affects versions earlier than `134.0.6998.177`. Security researchers at Kaspersky, **Boris Larin** and **Igor Kuznetsov**, discovered the vulnerability, and CSIRT.SK reported that it was being **actively exploited** in attacks targeting Russian companies. Users were urged to update Chrome immediately to versions `134.0.6998.177` or `134.0.6998.178`, and organizations using other **Chromium-based browsers** were advised to apply corresponding vendor patches as they become available.
Jul 24, 2026
Google reported that a single threat actor used five **zero-day vulnerabilities** across **Internet Explorer, Chrome, and the Windows kernel** in a 2019 campaign that primarily targeted people in North Korea and individuals working on North Korea-related issues. The attacks were delivered through compromised legitimate websites, links to malicious sites, and limited spear-phishing emails carrying attachments, showing a mix of web compromise and direct social-engineering tactics. Google said its Threat Analysis Group identified zero-days affecting **Android, Chrome, iOS, Internet Explorer, and Windows**, and published technical details on exploitation methods including escapes from the Internet Explorer **EPM sandbox** using **WPAD**. The company also highlighted its role in identifying **`CVE-2020-0674`**, an Internet Explorer remote code execution flaw later acknowledged by Microsoft, framing the disclosures as part of broader cross-platform vulnerability reporting intended to protect users.
Aug 15, 2026
Microsoft patched a critical Windows kernel elevation-of-privilege flaw, `CVE-2026-40369`, affecting Windows 11 versions 24H2 through 25H2 after public disclosure of technical details and proof-of-concept exploit code. The bug resides in `ntoskrnl.exe`, specifically `nt!ExpGetProcessInformation`, and can be triggered via `NtQuerySystemInformation`, including a zero-length request tied to information class `253`, causing an untrusted pointer dereference and unsafe kernel memory writes from an unprivileged process. Researchers said the vulnerability enables deterministic kernel memory modification, allowing attackers to build kernel read primitives, bypass KASLR, locate structures such as `EPROCESS`, alter token privileges, and ultimately obtain `NT AUTHORITY\SYSTEM` execution. Because the flaw is reachable from Chrome, Edge, and Firefox renderer sandboxes, it is considered especially dangerous for browser escape chains; defenders were urged to prioritize patching and watch for unusual `NtQuerySystemInformation` activity and anomalous kernel interaction patterns.
Jun 29, 2026