Loading story…
Researchers reported that the BITTER APT group used a Windows zero-day, CVE-2021-28310, to gain elevated privileges in targeted attacks. The flaw affects Desktop Window Manager via dwmcore.dll and stems from an out-of-bounds write reachable through the DirectComposition API. Kaspersky said it uncovered the issue while investigating exploitation activity linked to CVE-2021-1732, indicating the vulnerability was likely used as part of a broader exploit chain rather than as a standalone compromise method.
Microsoft confirmed the bug as a zero-day after receiving the report in February 2021 and later fixed it in its April 2021 security updates. According to the technical analysis, attackers could abuse inconsistencies between kernel-mode and user-mode property handling in DirectComposition to bypass checks, potentially escaping browser sandboxes or obtaining SYSTEM-level privileges. Researchers said the exploit had been used in the wild, but they did not capture the full chain or determine whether it was paired with another browser zero-day or previously patched vulnerabilities.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft released a fix for CVE-2021-28310 as part of its April 2021 security updates. The vulnerability affected dwmcore.dll and could be exploited for elevation of privilege.
While analyzing exploitation tied to CVE-2021-1732, Kaspersky discovered a separate zero-day elevation-of-privilege flaw in Desktop Window Manager and reported it to Microsoft. Microsoft confirmed it as a zero-day and assigned it CVE-2021-28310.
Kaspersky publicly reported that CVE-2021-28310 had been used in the wild and linked the activity to the same actor associated with CVE-2021-1732 exploitation, the BITTER APT group. The company said the flaw was likely used as part of a larger exploit chain, such as escaping a browser sandbox or gaining system privileges.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released fixes for 61 vulnerabilities in its May security updates, including three zero-days and one critical flaw, with **CVE-2024-30040** and **CVE-2024-30051** confirmed as actively exploited in the wild. The patched issues affect core Microsoft products including Windows, Office, SharePoint, .NET, Visual Studio, and Windows Server, and include a **Windows MSHTML Platform security feature bypass** and a **Windows DWM Core Library elevation-of-privilege flaw** that can allow attackers to gain `SYSTEM` privileges. Researchers who reported **CVE-2024-30051** said they validated the Windows Desktop Window Manager flaw after finding a suspicious document uploaded to VirusTotal, then later observed an exploit in mid-April being used with **QakBot** and other malware. Kaspersky assessed that multiple threat actors likely had access to the exploit before the patch was released, underscoring the urgency for organizations to deploy Microsoft's updates immediately across affected Windows and server environments.
Jul 24, 2026
Microsoft has issued security advisories for multiple **Desktop Window Manager (DWM) Core Library** elevation-of-privilege vulnerabilities affecting Windows, including `CVE-2022-21902`, `CVE-2022-41096`, `CVE-2024-43629`, `CVE-2025-21304`, and `CVE-2025-53801`. The flaws were published across several update cycles through the Microsoft Security Response Center, indicating a recurring security issue in the component responsible for Windows desktop composition and rendering. The advisories identify the vulnerabilities as **elevation of privilege** issues in the Windows or Microsoft DWM Core Library, meaning successful exploitation could allow an attacker with existing access to gain higher privileges on a targeted system. Microsoft released fixes through its Security Update Guide and related portal advisories, making patching a priority for organizations that rely on Windows endpoints and servers where the DWM component is present.
Jul 12, 2026
Microsoft patched **CVE-2019-0859**, a `win32k.sys` elevation-of-privilege flaw that Kaspersky said was exploited in the wild to give attackers higher privileges on affected Windows systems. The bug was a use-after-free condition in the `CreateWindowEx` path tied to `WM_NCCREATE` handling and manipulation of a window Function ID, allowing a freed window object to be reused for privilege escalation. Microsoft tracked the issue as a **Win32k Elevation of Privilege Vulnerability** in its Security Update Guide. Kaspersky reported attacks against 64-bit Windows systems ranging from Windows 7 to older Windows 10 builds, with exploitation observed in March 2019. According to the report, the exploit used `HMValidateHandle` to help bypass ASLR, then launched PowerShell to fetch additional payload stages; the final payload unpacked shellcode and opened an HTTP reverse shell, giving the attacker full control of the compromised machine.
Aug 15, 2026