{"vulnerability": "CVE-2021-33739", "sightings": [{"uuid": "b7619a39-20b3-4e13-b073-a2e6820a5d74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:18.000000Z"}, {"uuid": "60a1ac31-92cd-489e-862c-e4d0eced465d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "82169730-b70e-4ee2-a357-17e3282b754a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "seen", "source": "MISP/614dca03-d7e8-4ff3-b09a-8db466b74b35", "content": "", "creation_timestamp": "2024-11-14T06:09:05.000000Z"}, {"uuid": "22b00085-7c34-4540-b5e8-eda63ebab8ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971042", "content": "", "creation_timestamp": "2024-12-24T20:23:27.090348Z"}, {"uuid": "6e1e1e72-4e7f-42bf-8e29-70d079d9a985", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:56.000000Z"}, {"uuid": "75c5809b-3b0f-4e0e-b9c7-c12711755d09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:00:56.000000Z"}, {"uuid": "60322753-ed4d-4091-93e6-338cc9334337", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-33739", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=593", "content": "", "creation_timestamp": "2021-06-09T04:00:00.000000Z"}, {"uuid": "d46d14e3-0079-4e0c-8f6e-370bd8ef1c09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-33739", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b51aa925-7438-444b-b0f8-405aba260e3e", "content": "", "creation_timestamp": "2026-02-02T12:28:49.109478Z"}, {"uuid": "c5cba151-2d98-4251-a623-57ef968c1502", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/585", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-33739 PoC Analysis\nURL\uff1ahttps://github.com/giwon9977/CVE-2021-33739_PoC", "creation_timestamp": "2021-09-24T03:37:01.000000Z"}, {"uuid": "94e46fce-309b-4c16-9d04-19bd62006f7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "seen", "source": "https://t.me/alexmakus/4121", "content": "\u0411\u043e\u043b\u044c\u0448\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f Microsoft Windows, \u0432\u043a\u043b\u044e\u0447\u0430\u044f 6 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f (\u043d\u0443, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439 \u043a \u043d\u0438\u043c, \u043a\u043e\u043d\u0435\u0447\u043d\u043e \u0436\u0435)\n\n\u2013CVE-2021-33742, a remote code execution bug in a Windows HTML component.\n\u2013CVE-2021-31955, an information disclosure bug in the Windows Kernel\n\u2013CVE-2021-31956, an elevation of privilege flaw in Windows NTFS\n\u2013CVE-2021-33739, an elevation of privilege flaw in the Microsoft Desktop Window Manager\n\u2013CVE-2021-31201, an elevation of privilege flaw in the Microsoft Enhanced Cryptographic Provider\n\u2013CVE-2021-31199, an elevation of privilege flaw in the Microsoft Enhanced Cryptographic Provider\n\nhttps://krebsonsecurity.com/2021/06/microsoft-patches-six-zero-day-security-holes/", "creation_timestamp": "2021-06-09T04:51:08.000000Z"}, {"uuid": "da5c2baf-0c7c-4213-82c4-2ee049c5fbf9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "seen", "source": "Telegram/qO0N6oPhT540AWXj1upCs9Gz1avB-CrnJkIHg0gMDosBpiUf", "content": "", "creation_timestamp": "2025-03-08T04:36:10.000000Z"}, {"uuid": "d6f72019-307a-43d8-8cb8-8fe42ff4c379", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "published-proof-of-concept", "source": "Telegram/zIDM-Gy3mAx974bsu5SdwP6jSgPXui08E-h36TZao8DyaA", "content": "", "creation_timestamp": "2026-08-01T15:00:04.521149Z"}, {"uuid": "cfeead93-1799-4cde-a5ea-b3894ae59d98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/3581", "content": "#exploit \nCVE-2021-26868 LPE,\nCVE-2021-33739 EoP in Windows Graphics Component/Desktop Window Manager\nhttps://github.com/mavillon1/CVE-2021-33739-POC", "creation_timestamp": "2024-10-09T17:36:09.000000Z"}, {"uuid": "b5a14688-ac56-4105-9237-3b8b6ed8590a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/3732", "content": "#Analytics\nTop 10 Most Used Vulns of the Month (June 1-30)\nCVE-2021-1675 - Windows Print Spooler EoP\nhttps://t.me/cybersecuritytechnologies/3723\nCVE-2021-21985 - vSphere Client RCE\nhttps://t.me/cybersecuritytechnologies/3493\nCVE-2021-3560 - Privilege escalation with polkit\nhttps://t.me/cybersecuritytechnologies/3587\nCVE-2021-28476 - Hyper-V RCE in vmswitch.sys\nhttps://t.me/cybersecuritytechnologies/3514\nCVE-2020-3580 - XSS in Cisco ASA\nhttps://www.helpnetsecurity.com/2021/06/29/cve-2020-3580-exploit\nCVE-2021-31955/31956 - Windows NTFS EoP/Kernel Information Disclosure\nhttps://github.com/mavillon1/CVE-2021-31955-POC\nhttps://t.me/cybersecuritytechnologies/3705\nCVE-2021-33739 - MS DWM Core Library EoP\nhttps://t.me/cybersecuritytechnologies/3581\nCVE-2021-27850 - Apache Tapestry RCE\nhttps://t.me/cybersecuritytechnologies/3694\nCVE-2020-36289 - Atlassian Jira Unauth User Enum\nhttps://mobile.twitter.com/i/web/status/1402644004781633540", "creation_timestamp": "2021-07-01T11:03:01.000000Z"}, {"uuid": "e18d4f17-58e4-4641-812a-1211b622ccb7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "published-proof-of-concept", "source": "Telegram/zIDM-Gy3mAx974bsu5SdwP6jSgPXui08E-h36TZao8DyaA", "content": "", "creation_timestamp": "2026-08-02T00:00:43.194797Z"}, {"uuid": "df8a4a4c-ddc3-4c37-8770-4e55a3fcbc49", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/fef7ad28-732c-4e33-b593-6f3359fab390", "content": "", "creation_timestamp": "2026-06-19T12:47:48.804325Z"}, {"uuid": "5fa75413-5561-4374-b89c-26449b0526d2", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/cce93e0c-ad22-4e04-bdd4-d43ece1b753b", "content": "", "creation_timestamp": "2026-06-23T14:04:40.003538Z"}, {"uuid": "c5d1069f-2f6d-4c44-96e3-56f37acfa1c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "seen", "source": "Telegram/zIDM-Gy3mAx974bsu5SdwP6jSgPXui08E-h36TZao8DyaA", "content": "", "creation_timestamp": "2026-07-29T12:01:46.838496Z"}, {"uuid": "a691f36f-216e-4693-9e05-814368ef214c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "seen", "source": "Telegram/zIDM-Gy3mAx974bsu5SdwP6jSgPXui08E-h36TZao8DyaA", "content": "", "creation_timestamp": "2026-07-30T00:02:02.753014Z"}, {"uuid": "b8cd9d7b-2628-4f71-be7f-5aaf930d80b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "seen", "source": "https://t.me/cissp/3374", "content": "exploit \nCVE-2021-26868 LPE,\nCVE-2021-33739 EoP in Microsoft Windows Graphics Component / Desktop Window Manager (PoC)\nhttps://github.com/mavillon1/CVE-2021-33739-POC\n\nOffensive security\nNAC (Network Access Control) bypass\nhttps://luemmelsec.github.io/I-got-99-problems-but-my-NAC-aint-one\n]-> toolkit for bypassing 802.1x-2010 and 802.1x-2004:\nhttps://github.com/s0lst1c3/silentbridge", "creation_timestamp": "2026-09-01T17:00:48.715626Z"}, {"uuid": "c94f044e-f382-4775-ba76-7c3812692433", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "seen", "source": "https://t.me/hacking_Attack/12056", "content": "vulnerability in Chrome and Chromium browsers that allows attackers to exploit the Chrome renderer process (the processes that are responsible for what happens inside users\u2019 tabs).\nKaspersky experts did find and analyze the second exploit, however: An elevation of privilege exploit that exploits two distinct vulnerabilities in the Microsoft Windows OS kernel: CVE-2021-31955 and CVE-2021-31956. The CVE-2021-31955 bug \u201cis affiliated with SuperFetch, a feature first introduced in Windows Vista that aims to reduce software loading times by pre-loading commonly used applications into memory,\u201d they explained.\n\nThe second flaw, CVE-2021-31956, is an Elevation of Privilege vulnerability and heap-based buffer overflow. Kaspersky said that attackers used this vulnerability alongside Windows Notification Facility (WNF) \u201cto create arbitrary memory read/write primitives and execute malware modules with system privileges.\u201d\n\n\u201cOnce the attackers have used both the Chrome and Windows exploits to gain a foothold in the targeted system, the stager module downloads and executes a more complex malware dropper from a remote server,\u201d they continued. \u201cThis dropper then installs two executables, which pretend to be legitimate files belonging to Microsoft Windows OS. The second of these two executables is a remote shell module, which is able to download and upload files, create processes, sleep for certain periods of time, and delete itself from the infected system.\u201d\n\nBoris Larin, senior security researcher with Kaspersky\u2019s Global Research and Analysis Team (GReAT), said that the team hasn\u2019t been able to link these highly targeted attacks to any known threat actor: Hence the name PuzzleMaker and the determination to closely monitor the security landscape \u201cfor future activity or new insights about this group,\u201d he was quoted as saying in the press release.\n\nIf the current trend is any indication, expect to see more of the same, Larin said. \u201cOverall, of late, we\u2019ve been seeing several waves of high-profile threat activity being driven by zero-day exploits,\u201d he said. \u201cIt\u2019s a reminder that zero days continue to be the most effective method for infecting targets. Now that these vulnerabilities have been made publicly known, it\u2019s possible that we\u2019ll see an increase of their usage in attacks by this and other threat actors. That means it\u2019s very important for users to download the latest patch from Microsoft as soon as possible.\u201d CVE-2021-31199/CVE-2021-31201The two Enhanced Cryptographic Provider Elevation of Privilege vulnerabilities are linked to the Adobe Reader bug that came under active attack\u00a0last month (CVE-2021-28550), ZDI explained. \u201cIt\u2019s common to see privilege escalation paired with code execution bugs, and it seems these two vulnerabilities were the privilege escalation part of those exploits,\u201d he explained. \u201cIt is a bit unusual to see a delay between patch availability between the different parts of an active attack, but good to see these holes now getting closed.\u201d CVE-2021-33739Breen noted that privilege escalation vulnerabilities such as this one in the Microsoft DWM Core Library are just as valuable to attackers as RCEs. \u201cOnce they have gained an initial foothold, they can move laterally across the network and uncover further ways to escalate to system or domain-level access,\u201d he said. \u201cThis can be hugely damaging in the event of ransomware attacks, where high privileges can enable the attackers to stop or destroy backups and other security tools.\u201d\nSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-1-1-90x90.png RockYou2021: largest password compilation of all time leaked online \u2013 8.4 billion entries17 hours ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/microsoft-exploit-90x90.jpg Windows Container Malware Targets Kubernetes Clusters1 day ago\n* https://www.blackhatethicalhacking[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:37.737029Z"}, {"uuid": "73d1a54d-bbd0-4de4-a12d-3c29e9c7b290", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "seen", "source": "https://t.me/hacking_Attack/12054", "content": "Black Hat Ethical Hacking\nMicrosoft Patch Tuesday Fixes 6 In-The-Wild Exploits, 50 Flaws\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Microsoft Patch Tuesday Fixes 6 In-The-Wild Exploits, 50 FlawsPost Views: 53 \nReading Time: 2 Minutes\nResearchers discovered a highly targeted malware campaign launched in April, in which a new, unknown threat actor used two of the vulnerabilities that Microsoft said are under active attack.\nMicrosoft jumped on 50 vulnerabilities in this month\u2019s Patch Tuesday update, issuing fixes for CVEs in Microsoft Windows, .NET Core and Visual Studio, Microsoft Office, Microsoft Edge (Chromium-based and EdgeHTML), SharePoint Server, Hyper-V, Visual Studio Code \u2013 Kubernetes Tools, Windows HTML Platform, and Windows Remote Desktop.\n\nFive of the CVEs are rated Critical and 45 are rated Important in severity. Microsoft reported that six of the bugs are currently under active attack, while three are publicly known at the time of release.\n\nThe number might seem light \u2013 it represents six fewer patches than Microsoft released in May \u2013 but the number of critical vulnerabilities ticked up to five month-over-month.\n\nThose actively exploited vulnerabilities can enable an attacker to hijack a system. They have no workarounds, so some security experts are recommending that they be patched as the highest priority.\n\nThe six CVEs under active attack in the wild include four elevation of privilege vulnerabilities, one information disclosure vulnerability and one remote code execution (RCE) vulnerability.\nSee Also: RockYou2021: largest password compilation of all time leaked online \u2013 8.4 billion entries Critical Bugs of NoteCVE-2021-31985\u00a0is a critical RCE vulnerability in Microsoft\u2019s Defender antimalware software that should grab attention. A similar, critical bug in Defender was patched in January. The most serious of the year\u2019s first Patch Tuesday, that earlier Defender bug was an RCE vulnerability that came under active exploit.\n\nAnother critical flaw is CVE-2021-31963, a Microsoft SharePoint Server RCE vulnerability. Jay Goodman, director of product marketing at Automox, said in a blog post\u00a0that an attacker exploiting this vulnerability \u201ccould take control of a system where they would be free to install programs, view or change data, or create new accounts on the target system with full user rights.\u201d\nWhile Microsoft reports that this vulnerability is less likely to be exploited,Goodman suggested that organizations don\u2019t let it slide: \u201cPatching critical vulnerabilities in the 72-hour window before attackers can weaponize is an important first step to maintaining a safe and secure infrastructure,\u201d he observed. https://media.threatpost.com/wp-content/uploads/sites/103/2021/06/08141612/Sophos-impact-chart-June-21-patch-Tuesday-e1623176186946.png A year-to-date summary of 2021 Microsoft vulnerability releases as of June. Source: Sophos\nSee Also: Offensive Security Tool: Pacu \u2013 The Amazon Web Services Exploitation Framework Bugs Exploited in the WildMicrosoft fixed a total of seven zero-day vulnerabilities. One was CVE-2021-31968, Windows Remote Desktop Services Denial of Service Vulnerability that was publicly disclosed but hasn\u2019t been seen in attacks. It was issued a CVSS score of 7.5.\n\nThese are the six flaws that MIcrosoft said are under active attack, all of them also zero days.\n\n* CVE-2021-31955\u00a0\u2013 Windows Kernel Information Disclosure Vulnerability. Rating: Important. CVSS 5.5\n* CVE-2021-31956\u00a0\u2013 Windows NTFS Elevation of Privilege Vulnerability. Rating: Important. CVSS 7.8\n* CVE-2021-33739\u00a0\u2013 Microsoft DWM Core Library Elevation of Privilege Vulnerability. Rating: Importa[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:38.335401Z"}, {"uuid": "527551dc-b839-481a-9d14-2ac9ff2286e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "seen", "source": "https://t.me/cissp/3374", "content": "exploit \nCVE-2021-26868 LPE,\nCVE-2021-33739 EoP in Microsoft Windows Graphics Component / Desktop Window Manager (PoC)\nhttps://github.com/mavillon1/CVE-2021-33739-POC\n\nOffensive security\nNAC (Network Access Control) bypass\nhttps://luemmelsec.github.io/I-got-99-problems-but-my-NAC-aint-one\n]-> toolkit for bypassing 802.1x-2010 and 802.1x-2004:\nhttps://github.com/s0lst1c3/silentbridge", "creation_timestamp": "2026-09-02T01:04:36.107789Z"}, {"uuid": "d61a8d2f-bdf6-4051-9c11-c2edbe1dbabb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "seen", "source": "https://t.me/hacking_Attack/12056", "content": "vulnerability in Chrome and Chromium browsers that allows attackers to exploit the Chrome renderer process (the processes that are responsible for what happens inside users\u2019 tabs).\nKaspersky experts did find and analyze the second exploit, however: An elevation of privilege exploit that exploits two distinct vulnerabilities in the Microsoft Windows OS kernel: CVE-2021-31955 and CVE-2021-31956. The CVE-2021-31955 bug \u201cis affiliated with SuperFetch, a feature first introduced in Windows Vista that aims to reduce software loading times by pre-loading commonly used applications into memory,\u201d they explained.\n\nThe second flaw, CVE-2021-31956, is an Elevation of Privilege vulnerability and heap-based buffer overflow. Kaspersky said that attackers used this vulnerability alongside Windows Notification Facility (WNF) \u201cto create arbitrary memory read/write primitives and execute malware modules with system privileges.\u201d\n\n\u201cOnce the attackers have used both the Chrome and Windows exploits to gain a foothold in the targeted system, the stager module downloads and executes a more complex malware dropper from a remote server,\u201d they continued. \u201cThis dropper then installs two executables, which pretend to be legitimate files belonging to Microsoft Windows OS. The second of these two executables is a remote shell module, which is able to download and upload files, create processes, sleep for certain periods of time, and delete itself from the infected system.\u201d\n\nBoris Larin, senior security researcher with Kaspersky\u2019s Global Research and Analysis Team (GReAT), said that the team hasn\u2019t been able to link these highly targeted attacks to any known threat actor: Hence the name PuzzleMaker and the determination to closely monitor the security landscape \u201cfor future activity or new insights about this group,\u201d he was quoted as saying in the press release.\n\nIf the current trend is any indication, expect to see more of the same, Larin said. \u201cOverall, of late, we\u2019ve been seeing several waves of high-profile threat activity being driven by zero-day exploits,\u201d he said. \u201cIt\u2019s a reminder that zero days continue to be the most effective method for infecting targets. Now that these vulnerabilities have been made publicly known, it\u2019s possible that we\u2019ll see an increase of their usage in attacks by this and other threat actors. That means it\u2019s very important for users to download the latest patch from Microsoft as soon as possible.\u201d CVE-2021-31199/CVE-2021-31201The two Enhanced Cryptographic Provider Elevation of Privilege vulnerabilities are linked to the Adobe Reader bug that came under active attack\u00a0last month (CVE-2021-28550), ZDI explained. \u201cIt\u2019s common to see privilege escalation paired with code execution bugs, and it seems these two vulnerabilities were the privilege escalation part of those exploits,\u201d he explained. \u201cIt is a bit unusual to see a delay between patch availability between the different parts of an active attack, but good to see these holes now getting closed.\u201d CVE-2021-33739Breen noted that privilege escalation vulnerabilities such as this one in the Microsoft DWM Core Library are just as valuable to attackers as RCEs. \u201cOnce they have gained an initial foothold, they can move laterally across the network and uncover further ways to escalate to system or domain-level access,\u201d he said. \u201cThis can be hugely damaging in the event of ransomware attacks, where high privileges can enable the attackers to stop or destroy backups and other security tools.\u201d\nSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-1-1-90x90.png RockYou2021: largest password compilation of all time leaked online \u2013 8.4 billion entries17 hours ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/microsoft-exploit-90x90.jpg Windows Container Malware Targets Kubernetes Clusters1 day ago\n* https://www.blackhatethicalhacking[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:13.524959Z"}, {"uuid": "4d123463-cb23-4bd8-a67e-c7c9ea43f2dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "seen", "source": "https://t.me/hacking_Attack/12054", "content": "Black Hat Ethical Hacking\nMicrosoft Patch Tuesday Fixes 6 In-The-Wild Exploits, 50 Flaws\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Microsoft Patch Tuesday Fixes 6 In-The-Wild Exploits, 50 FlawsPost Views: 53 \nReading Time: 2 Minutes\nResearchers discovered a highly targeted malware campaign launched in April, in which a new, unknown threat actor used two of the vulnerabilities that Microsoft said are under active attack.\nMicrosoft jumped on 50 vulnerabilities in this month\u2019s Patch Tuesday update, issuing fixes for CVEs in Microsoft Windows, .NET Core and Visual Studio, Microsoft Office, Microsoft Edge (Chromium-based and EdgeHTML), SharePoint Server, Hyper-V, Visual Studio Code \u2013 Kubernetes Tools, Windows HTML Platform, and Windows Remote Desktop.\n\nFive of the CVEs are rated Critical and 45 are rated Important in severity. Microsoft reported that six of the bugs are currently under active attack, while three are publicly known at the time of release.\n\nThe number might seem light \u2013 it represents six fewer patches than Microsoft released in May \u2013 but the number of critical vulnerabilities ticked up to five month-over-month.\n\nThose actively exploited vulnerabilities can enable an attacker to hijack a system. They have no workarounds, so some security experts are recommending that they be patched as the highest priority.\n\nThe six CVEs under active attack in the wild include four elevation of privilege vulnerabilities, one information disclosure vulnerability and one remote code execution (RCE) vulnerability.\nSee Also: RockYou2021: largest password compilation of all time leaked online \u2013 8.4 billion entries Critical Bugs of NoteCVE-2021-31985\u00a0is a critical RCE vulnerability in Microsoft\u2019s Defender antimalware software that should grab attention. A similar, critical bug in Defender was patched in January. The most serious of the year\u2019s first Patch Tuesday, that earlier Defender bug was an RCE vulnerability that came under active exploit.\n\nAnother critical flaw is CVE-2021-31963, a Microsoft SharePoint Server RCE vulnerability. Jay Goodman, director of product marketing at Automox, said in a blog post\u00a0that an attacker exploiting this vulnerability \u201ccould take control of a system where they would be free to install programs, view or change data, or create new accounts on the target system with full user rights.\u201d\nWhile Microsoft reports that this vulnerability is less likely to be exploited,Goodman suggested that organizations don\u2019t let it slide: \u201cPatching critical vulnerabilities in the 72-hour window before attackers can weaponize is an important first step to maintaining a safe and secure infrastructure,\u201d he observed. https://media.threatpost.com/wp-content/uploads/sites/103/2021/06/08141612/Sophos-impact-chart-June-21-patch-Tuesday-e1623176186946.png A year-to-date summary of 2021 Microsoft vulnerability releases as of June. Source: Sophos\nSee Also: Offensive Security Tool: Pacu \u2013 The Amazon Web Services Exploitation Framework Bugs Exploited in the WildMicrosoft fixed a total of seven zero-day vulnerabilities. One was CVE-2021-31968, Windows Remote Desktop Services Denial of Service Vulnerability that was publicly disclosed but hasn\u2019t been seen in attacks. It was issued a CVSS score of 7.5.\n\nThese are the six flaws that MIcrosoft said are under active attack, all of them also zero days.\n\n* CVE-2021-31955\u00a0\u2013 Windows Kernel Information Disclosure Vulnerability. Rating: Important. CVSS 5.5\n* CVE-2021-31956\u00a0\u2013 Windows NTFS Elevation of Privilege Vulnerability. Rating: Important. CVSS 7.8\n* CVE-2021-33739\u00a0\u2013 Microsoft DWM Core Library Elevation of Privilege Vulnerability. Rating: Importa[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:14.033420Z"}, {"uuid": "409ab341-530b-4e13-8941-7c5ea51bd96f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "seen", "source": "https://t.me/hacking_Attack/12056", "content": "vulnerability in Chrome and Chromium browsers that allows attackers to exploit the Chrome renderer process (the processes that are responsible for what happens inside users\u2019 tabs).\nKaspersky experts did find and analyze the second exploit, however: An elevation of privilege exploit that exploits two distinct vulnerabilities in the Microsoft Windows OS kernel: CVE-2021-31955 and CVE-2021-31956. The CVE-2021-31955 bug \u201cis affiliated with SuperFetch, a feature first introduced in Windows Vista that aims to reduce software loading times by pre-loading commonly used applications into memory,\u201d they explained.\n\nThe second flaw, CVE-2021-31956, is an Elevation of Privilege vulnerability and heap-based buffer overflow. Kaspersky said that attackers used this vulnerability alongside Windows Notification Facility (WNF) \u201cto create arbitrary memory read/write primitives and execute malware modules with system privileges.\u201d\n\n\u201cOnce the attackers have used both the Chrome and Windows exploits to gain a foothold in the targeted system, the stager module downloads and executes a more complex malware dropper from a remote server,\u201d they continued. \u201cThis dropper then installs two executables, which pretend to be legitimate files belonging to Microsoft Windows OS. The second of these two executables is a remote shell module, which is able to download and upload files, create processes, sleep for certain periods of time, and delete itself from the infected system.\u201d\n\nBoris Larin, senior security researcher with Kaspersky\u2019s Global Research and Analysis Team (GReAT), said that the team hasn\u2019t been able to link these highly targeted attacks to any known threat actor: Hence the name PuzzleMaker and the determination to closely monitor the security landscape \u201cfor future activity or new insights about this group,\u201d he was quoted as saying in the press release.\n\nIf the current trend is any indication, expect to see more of the same, Larin said. \u201cOverall, of late, we\u2019ve been seeing several waves of high-profile threat activity being driven by zero-day exploits,\u201d he said. \u201cIt\u2019s a reminder that zero days continue to be the most effective method for infecting targets. Now that these vulnerabilities have been made publicly known, it\u2019s possible that we\u2019ll see an increase of their usage in attacks by this and other threat actors. That means it\u2019s very important for users to download the latest patch from Microsoft as soon as possible.\u201d CVE-2021-31199/CVE-2021-31201The two Enhanced Cryptographic Provider Elevation of Privilege vulnerabilities are linked to the Adobe Reader bug that came under active attack\u00a0last month (CVE-2021-28550), ZDI explained. \u201cIt\u2019s common to see privilege escalation paired with code execution bugs, and it seems these two vulnerabilities were the privilege escalation part of those exploits,\u201d he explained. \u201cIt is a bit unusual to see a delay between patch availability between the different parts of an active attack, but good to see these holes now getting closed.\u201d CVE-2021-33739Breen noted that privilege escalation vulnerabilities such as this one in the Microsoft DWM Core Library are just as valuable to attackers as RCEs. \u201cOnce they have gained an initial foothold, they can move laterally across the network and uncover further ways to escalate to system or domain-level access,\u201d he said. \u201cThis can be hugely damaging in the event of ransomware attacks, where high privileges can enable the attackers to stop or destroy backups and other security tools.\u201d\nSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-1-1-90x90.png RockYou2021: largest password compilation of all time leaked online \u2013 8.4 billion entries17 hours ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/microsoft-exploit-90x90.jpg Windows Container Malware Targets Kubernetes Clusters1 day ago\n* https://www.blackhatethicalhacking[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T03:00:05.170225Z"}, {"uuid": "f3eade87-9d14-4874-90aa-196c72924b17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "exploited", "source": "https://t.me/hacking_Attack/12054", "content": "Black Hat Ethical Hacking\nMicrosoft Patch Tuesday Fixes 6 In-The-Wild Exploits, 50 Flaws\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Microsoft Patch Tuesday Fixes 6 In-The-Wild Exploits, 50 FlawsPost Views: 53 \nReading Time: 2 Minutes\nResearchers discovered a highly targeted malware campaign launched in April, in which a new, unknown threat actor used two of the vulnerabilities that Microsoft said are under active attack.\nMicrosoft jumped on 50 vulnerabilities in this month\u2019s Patch Tuesday update, issuing fixes for CVEs in Microsoft Windows, .NET Core and Visual Studio, Microsoft Office, Microsoft Edge (Chromium-based and EdgeHTML), SharePoint Server, Hyper-V, Visual Studio Code \u2013 Kubernetes Tools, Windows HTML Platform, and Windows Remote Desktop.\n\nFive of the CVEs are rated Critical and 45 are rated Important in severity. Microsoft reported that six of the bugs are currently under active attack, while three are publicly known at the time of release.\n\nThe number might seem light \u2013 it represents six fewer patches than Microsoft released in May \u2013 but the number of critical vulnerabilities ticked up to five month-over-month.\n\nThose actively exploited vulnerabilities can enable an attacker to hijack a system. They have no workarounds, so some security experts are recommending that they be patched as the highest priority.\n\nThe six CVEs under active attack in the wild include four elevation of privilege vulnerabilities, one information disclosure vulnerability and one remote code execution (RCE) vulnerability.\nSee Also: RockYou2021: largest password compilation of all time leaked online \u2013 8.4 billion entries Critical Bugs of NoteCVE-2021-31985\u00a0is a critical RCE vulnerability in Microsoft\u2019s Defender antimalware software that should grab attention. A similar, critical bug in Defender was patched in January. The most serious of the year\u2019s first Patch Tuesday, that earlier Defender bug was an RCE vulnerability that came under active exploit.\n\nAnother critical flaw is CVE-2021-31963, a Microsoft SharePoint Server RCE vulnerability. Jay Goodman, director of product marketing at Automox, said in a blog post\u00a0that an attacker exploiting this vulnerability \u201ccould take control of a system where they would be free to install programs, view or change data, or create new accounts on the target system with full user rights.\u201d\nWhile Microsoft reports that this vulnerability is less likely to be exploited,Goodman suggested that organizations don\u2019t let it slide: \u201cPatching critical vulnerabilities in the 72-hour window before attackers can weaponize is an important first step to maintaining a safe and secure infrastructure,\u201d he observed. https://media.threatpost.com/wp-content/uploads/sites/103/2021/06/08141612/Sophos-impact-chart-June-21-patch-Tuesday-e1623176186946.png A year-to-date summary of 2021 Microsoft vulnerability releases as of June. Source: Sophos\nSee Also: Offensive Security Tool: Pacu \u2013 The Amazon Web Services Exploitation Framework Bugs Exploited in the WildMicrosoft fixed a total of seven zero-day vulnerabilities. One was CVE-2021-31968, Windows Remote Desktop Services Denial of Service Vulnerability that was publicly disclosed but hasn\u2019t been seen in attacks. It was issued a CVSS score of 7.5.\n\nThese are the six flaws that MIcrosoft said are under active attack, all of them also zero days.\n\n* CVE-2021-31955\u00a0\u2013 Windows Kernel Information Disclosure Vulnerability. Rating: Important. CVSS 5.5\n* CVE-2021-31956\u00a0\u2013 Windows NTFS Elevation of Privilege Vulnerability. Rating: Important. CVSS 7.8\n* CVE-2021-33739\u00a0\u2013 Microsoft DWM Core Library Elevation of Privilege Vulnerability. Rating: Importa[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T04:00:04.886761Z"}, {"uuid": "fce2d689-9d3e-4ddd-a1c3-74166f8ae8f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "exploited", "source": "https://t.me/hacking_Attack/12054", "content": "Black Hat Ethical Hacking\nMicrosoft Patch Tuesday Fixes 6 In-The-Wild Exploits, 50 Flaws\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Microsoft Patch Tuesday Fixes 6 In-The-Wild Exploits, 50 FlawsPost Views: 53 \nReading Time: 2 Minutes\nResearchers discovered a highly targeted malware campaign launched in April, in which a new, unknown threat actor used two of the vulnerabilities that Microsoft said are under active attack.\nMicrosoft jumped on 50 vulnerabilities in this month\u2019s Patch Tuesday update, issuing fixes for CVEs in Microsoft Windows, .NET Core and Visual Studio, Microsoft Office, Microsoft Edge (Chromium-based and EdgeHTML), SharePoint Server, Hyper-V, Visual Studio Code \u2013 Kubernetes Tools, Windows HTML Platform, and Windows Remote Desktop.\n\nFive of the CVEs are rated Critical and 45 are rated Important in severity. Microsoft reported that six of the bugs are currently under active attack, while three are publicly known at the time of release.\n\nThe number might seem light \u2013 it represents six fewer patches than Microsoft released in May \u2013 but the number of critical vulnerabilities ticked up to five month-over-month.\n\nThose actively exploited vulnerabilities can enable an attacker to hijack a system. They have no workarounds, so some security experts are recommending that they be patched as the highest priority.\n\nThe six CVEs under active attack in the wild include four elevation of privilege vulnerabilities, one information disclosure vulnerability and one remote code execution (RCE) vulnerability.\nSee Also: RockYou2021: largest password compilation of all time leaked online \u2013 8.4 billion entries Critical Bugs of NoteCVE-2021-31985\u00a0is a critical RCE vulnerability in Microsoft\u2019s Defender antimalware software that should grab attention. A similar, critical bug in Defender was patched in January. The most serious of the year\u2019s first Patch Tuesday, that earlier Defender bug was an RCE vulnerability that came under active exploit.\n\nAnother critical flaw is CVE-2021-31963, a Microsoft SharePoint Server RCE vulnerability. Jay Goodman, director of product marketing at Automox, said in a blog post\u00a0that an attacker exploiting this vulnerability \u201ccould take control of a system where they would be free to install programs, view or change data, or create new accounts on the target system with full user rights.\u201d\nWhile Microsoft reports that this vulnerability is less likely to be exploited,Goodman suggested that organizations don\u2019t let it slide: \u201cPatching critical vulnerabilities in the 72-hour window before attackers can weaponize is an important first step to maintaining a safe and secure infrastructure,\u201d he observed. https://media.threatpost.com/wp-content/uploads/sites/103/2021/06/08141612/Sophos-impact-chart-June-21-patch-Tuesday-e1623176186946.png A year-to-date summary of 2021 Microsoft vulnerability releases as of June. Source: Sophos\nSee Also: Offensive Security Tool: Pacu \u2013 The Amazon Web Services Exploitation Framework Bugs Exploited in the WildMicrosoft fixed a total of seven zero-day vulnerabilities. One was CVE-2021-31968, Windows Remote Desktop Services Denial of Service Vulnerability that was publicly disclosed but hasn\u2019t been seen in attacks. It was issued a CVSS score of 7.5.\n\nThese are the six flaws that MIcrosoft said are under active attack, all of them also zero days.\n\n* CVE-2021-31955\u00a0\u2013 Windows Kernel Information Disclosure Vulnerability. Rating: Important. CVSS 5.5\n* CVE-2021-31956\u00a0\u2013 Windows NTFS Elevation of Privilege Vulnerability. Rating: Important. CVSS 7.8\n* CVE-2021-33739\u00a0\u2013 Microsoft DWM Core Library Elevation of Privilege Vulnerability. Rating: Importa[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-09T00:00:44.031201Z"}, {"uuid": "0cd783e9-1b20-461f-9bb2-53426c7f3904", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-33739", "type": "seen", "source": "https://t.me/hacking_Attack/12056", "content": "vulnerability in Chrome and Chromium browsers that allows attackers to exploit the Chrome renderer process (the processes that are responsible for what happens inside users\u2019 tabs).\nKaspersky experts did find and analyze the second exploit, however: An elevation of privilege exploit that exploits two distinct vulnerabilities in the Microsoft Windows OS kernel: CVE-2021-31955 and CVE-2021-31956. The CVE-2021-31955 bug \u201cis affiliated with SuperFetch, a feature first introduced in Windows Vista that aims to reduce software loading times by pre-loading commonly used applications into memory,\u201d they explained.\n\nThe second flaw, CVE-2021-31956, is an Elevation of Privilege vulnerability and heap-based buffer overflow. Kaspersky said that attackers used this vulnerability alongside Windows Notification Facility (WNF) \u201cto create arbitrary memory read/write primitives and execute malware modules with system privileges.\u201d\n\n\u201cOnce the attackers have used both the Chrome and Windows exploits to gain a foothold in the targeted system, the stager module downloads and executes a more complex malware dropper from a remote server,\u201d they continued. \u201cThis dropper then installs two executables, which pretend to be legitimate files belonging to Microsoft Windows OS. The second of these two executables is a remote shell module, which is able to download and upload files, create processes, sleep for certain periods of time, and delete itself from the infected system.\u201d\n\nBoris Larin, senior security researcher with Kaspersky\u2019s Global Research and Analysis Team (GReAT), said that the team hasn\u2019t been able to link these highly targeted attacks to any known threat actor: Hence the name PuzzleMaker and the determination to closely monitor the security landscape \u201cfor future activity or new insights about this group,\u201d he was quoted as saying in the press release.\n\nIf the current trend is any indication, expect to see more of the same, Larin said. \u201cOverall, of late, we\u2019ve been seeing several waves of high-profile threat activity being driven by zero-day exploits,\u201d he said. \u201cIt\u2019s a reminder that zero days continue to be the most effective method for infecting targets. Now that these vulnerabilities have been made publicly known, it\u2019s possible that we\u2019ll see an increase of their usage in attacks by this and other threat actors. That means it\u2019s very important for users to download the latest patch from Microsoft as soon as possible.\u201d CVE-2021-31199/CVE-2021-31201The two Enhanced Cryptographic Provider Elevation of Privilege vulnerabilities are linked to the Adobe Reader bug that came under active attack\u00a0last month (CVE-2021-28550), ZDI explained. \u201cIt\u2019s common to see privilege escalation paired with code execution bugs, and it seems these two vulnerabilities were the privilege escalation part of those exploits,\u201d he explained. \u201cIt is a bit unusual to see a delay between patch availability between the different parts of an active attack, but good to see these holes now getting closed.\u201d CVE-2021-33739Breen noted that privilege escalation vulnerabilities such as this one in the Microsoft DWM Core Library are just as valuable to attackers as RCEs. \u201cOnce they have gained an initial foothold, they can move laterally across the network and uncover further ways to escalate to system or domain-level access,\u201d he said. \u201cThis can be hugely damaging in the event of ransomware attacks, where high privileges can enable the attackers to stop or destroy backups and other security tools.\u201d\nSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-1-1-90x90.png RockYou2021: largest password compilation of all time leaked online \u2013 8.4 billion entries17 hours ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/microsoft-exploit-90x90.jpg Windows Container Malware Targets Kubernetes Clusters1 day ago\n* https://www.blackhatethicalhacking[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-09T00:00:45.208098Z"}]}