BITTER APT Used Windows Desktop Window Manager Zero-Day for Privilege Escalation

Researchers reported that the BITTER APT group used a Windows zero-day, CVE-2021-28310, to gain elevated privileges in targeted attacks. The flaw affects Desktop Window Manager via dwmcore.dll and stems from an out-of-bounds write reachable through the DirectComposition API. Kaspersky said it uncovered the issue while investigating exploitation activity linked to CVE-2021-1732, indicating the vulnerability was likely used as part of a broader exploit chain rather than as a standalone compromise method.

Microsoft confirmed the bug as a zero-day after receiving the report in February 2021 and later fixed it in its April 2021 security updates. According to the technical analysis, attackers could abuse inconsistencies between kernel-mode and user-mode property handling in DirectComposition to bypass checks, potentially escaping browser sandboxes or obtaining SYSTEM-level privileges. Researchers said the exploit had been used in the wild, but they did not capture the full chain or determine whether it was paired with another browser zero-day or previously patched vulnerabilities.