Loading story…
Microsoft's September 2026 Windows 11 update, KB5124008, fully removes the deprecated Windows Management Instrumentation Command-line utility (WMIC) and no longer provides it as a Feature on Demand. WMIC has been used legitimately for administrative automation, but ransomware and other malware have abused it to delete Volume Shadow Copies—undermining recovery—and weaken Microsoft Defender protections. Reported malware associated with WMIC techniques includes TeslaCrypt 4.1b, DeroHE, WannaCry, Serpent, WhiteRose, Zenis, and Saturn.
Organizations using WMIC in applications, scripts, or operational workflows should migrate to supported Windows management alternatives and validate replacements before deployment. Microsoft offers a temporary downloadable WMIC package only for compatibility scenarios, but advises against restoring the utility broadly because retaining it preserves an attack surface frequently leveraged for defense evasion and ransomware recovery inhibition.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft's September 2026 Windows 11 update KB5124008, which updates systems to build 26200.9445, fully removes WMIC and no longer offers it as a Feature on Demand. Microsoft advised organizations to migrate dependent scripts, applications, and workflows to supported alternatives, with a temporary downloadable compatibility package available.
Microsoft deprecated the Windows Management Instrumentation Command-line utility (WMIC) with Windows 10 version 21H1, though it remained available as a Feature on Demand.
Attackers distributed DeroHE ransomware through forums. The ransomware used WMIC commands to add exclusions in Microsoft Defender.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcereddit.com
Open sourcewindowslatest.com
Open sourcelearn.microsoft.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has removed the legacy **Windows Management Instrumentation Command-line** utility, `WMIC`, from Windows 11 versions **24H2** and **25H2**, including recent beta builds, as part of a multi-year deprecation effort. The company said `WMIC` is no longer included in new installations and is no longer available as a **Feature on Demand**, extending a phaseout that previously left the tool deprecated and then disabled by default. Microsoft emphasized that the change affects only the `WMIC` command-line utility, while the underlying **WMI** infrastructure remains supported. The removal follows years of documented abuse of `WMIC` as a **living-off-the-land binary** listed by the LOLBAS project and widely used by malware and ransomware operators after compromise. Threat actors have used the tool to enumerate installed security products, delete Shadow Volume Copies, uninstall antivirus software, and add Microsoft Defender exclusions, making it useful for reconnaissance, defense evasion, and ransomware staging. Microsoft said PowerShell and other modern management tools are the intended replacements for legitimate administrative use.
Aug 21, 2026
Ransomware operators have repeatedly used tools and policy abuse to disable Microsoft Defender before encrypting Windows environments. DFIR reporting documented the freeware utility **Defender Control** being used in real intrusions by groups such as **Dharma**, **Phobos**, and **Crysis**, typically after access through exposed RDP, to turn off Defender through registry edits, service changes, driver unloading, and local group policy modifications. Separately, **LockBit 2.0** automated the same objective at enterprise scale by creating malicious Active Directory group policies on a domain controller, disabling Defender across domain-joined systems, and launching ransomware via scheduled tasks after enumerating hosts with AD and LDAP queries. More recent intrusions show the tactic evolving beyond simple utilities into **BYOVD** and broader policy abuse. WithSecure reported that the **CrazyHunter** ransomware actor used the vulnerable **Zemana Anti-Logger** driver `zam64.sys` to disable both Windows Defender and Trend Micro during attacks on Taiwanese hospitals and industrial organizations, including the Mackay Memorial Hospital incident. The operation also used publicly available tooling such as **SharpGPOAbuse** for lateral movement and persistence, reinforcing that defense evasion through Defender tampering and group policy manipulation remains a practical, low-barrier technique for ransomware actors ranging from smaller crews to more organized operators.
Aug 14, 2026
Microsoft issued security updates to remediate a Windows Remote Assistance protection-mechanism failure, **CVE-2026-20824**, that can allow attackers to **bypass Mark of the Web (MOTW)**—a key Windows control used to flag and apply additional restrictions to files originating from the internet. Reporting notes the issue is not “wormable” and requires local execution plus user interaction, but it can materially weaken common download-based defenses and be chained with other techniques to increase the likelihood of successful payload execution. Separately, Microsoft released an **out-of-band/emergency fix** after a Patch Tuesday update introduced a Windows 11 23H2 regression where some systems configured with **Secure Launch** restart instead of shutting down (and may also fail to hibernate). A documented workaround for affected endpoints is to invoke shutdown via Command Prompt using: ``` shutdown /s /t 0 ``` Other items in the set are not part of these Windows security/patch events: a PowerToys feature update, an iOS upgrade opinion piece, and a Windows 11 edition comparison.
Jun 29, 2026