Loading story…
Microsoft published VM Assist troubleshooting guidance for Azure virtual-machine guest agents on both Linux and Windows. The tools are intended to help administrators diagnose guest-agent issues that can affect VM extension deployment, status reporting, and management operations.
Microsoft also reiterated that the Azure PowerShell Desired State Configuration (DSC) VM extension will retire on March 31, 2028 and recommends migration to Azure Machine Configuration, including support for Arc-enabled servers. The extension applies PowerShell DSC packages through the VM Extension framework, compiles MOF configuration, runs Start-DscConfiguration -Force, and reports results through Azure’s status channel; removing its handler does not reverse configuration already applied to the VM or uninstall Windows Management Framework.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft states that the Azure PowerShell Desired State Configuration VM extension will be retired on March 31, 2028, and recommends customers migrate to Azure Machine Configuration, including Arc-enabled server support.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
aka.ms
Open sourceaka.ms
Open sourcedocs.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft patched **CVE-2022-29149**, a CVSS 7.8 local privilege-escalation vulnerability in Open Management Infrastructure (OMI) versions earlier than `1.6.9-1`. OMI, Linux/UNIX management middleware that can be installed through Azure monitoring and management agents, used a predictable time-based seed in its `secretString` authentication mechanism. A low-privileged local attacker could reconstruct the secret, forge privileged internal messages, and obtain root access, with high confidentiality, integrity, and availability impact. Microsoft directed customers to update affected OMI installations and dependent Azure and System Center components, including agents, VM extensions, management packs, container images, and Azure Stack Hub extensions. Following researcher coordination, Microsoft expanded customer notifications and added Automatic Extension Upgrade support for OMS, Linux Azure Diagnostics, and Desired State Configuration agents; enabling it automatically updates bundled OMI. Organizations should inventory potentially silently deployed cloud-management agents, enable automatic extension upgrades where available, manually remediate unsupported deployments, and migrate to Azure Monitor Agent where feasible because it does not rely on OMI.
Sep 3, 2026
Microsoft has confirmed the phased removal of Defender Application Guard (MDAG) from Office, with the process beginning in February 2026 and concluding by December 2027. MDAG, which isolates untrusted Office documents in a Hyper-V sandbox to protect against malware, will be replaced by alternative security measures such as Protected View, Defender for Endpoint attack surface reduction (ASR) rules, and Windows Defender Application Control. The company cites performance improvements and a streamlined security experience as reasons for the change, while also acknowledging that the isolation approach, though effective, introduced slower document load times and was occasionally susceptible to vulnerabilities in the sandbox layer. Administrators are advised to prepare for the transition by enabling recommended alternative protections, as no direct action is required for the removal itself. Microsoft has provided a detailed timeline for the deprecation across different Office update channels, ensuring enterprises have ample time to adapt. The move aligns with the end of support for Windows 11 version 23H2 and reflects a broader shift in Microsoft's security strategy for Office environments.
Jun 29, 2026
Microsoft has confirmed that the November 2025 non-security preview update KB5070311 and subsequent patches for Windows 11 (versions 24H2 and 25H2) and Windows Server 2025 are causing RemoteApp connection failures in Azure Virtual Desktop (AVD) environments. This issue primarily impacts enterprise users who rely on RemoteApp to stream individual applications, while full desktop sessions and personal devices running Windows Home or Pro are largely unaffected. The disruption stems from changes to Remote Desktop Protocol (RDP) shell handling introduced by the update, leading to widespread difficulties for organizations dependent on virtualized workloads. To address the problem, Microsoft has provided two main mitigation options: a manual registry edit requiring administrative privileges, and the use of Known Issue Rollback (KIR), which automatically reverts the problematic update for Pro and Enterprise devices. Enterprise administrators managing updates via IT policies can also deploy a targeted Group Policy using a specific MSI package. Microsoft has urged affected organizations to implement these workarounds promptly to restore RemoteApp functionality and minimize operational impact.
Jun 29, 2026