RANSOMWARE 🔴 1×KEV
CVE-2024-37085 in Microsoft Products: Actively Exploited in GPO-Based Ransomware Attacks (KEV Confirmed)
- CVE-2024-37085 is an unspecified vulnerability in Microsoft products, confirmed by CISA to be actively exploited in the wild.
- The vulnerability is leveraged in ransomware campaigns that manipulate Group Policy Objects (GPOs). It is listed on CISA's KEV catalog and has a high EPSS score of 0.74835.
- Immediate investigation is required to hunt for signs of GPO manipulation. Microsoft reports its Defender product provides predictive shielding against related attacks.
Technical Analysis
CONFIRMED reports from Microsoft indicate that CVE-2024-37085 is being exploited in ransomware attacks. The attack chain involves the manipulation of Group Policy Objects (GPOs) within a Microsoft Active Directory environment. While the specific vulnerability class (e.g., RCE, LPE) has not been disclosed, the vector implies that attackers have already gained initial access and possess privileges sufficient to edit GPOs. By modifying GPOs, threat actors can achieve widespread and rapid deployment of ransomware payloads across all domain-joined systems, a high-impact lateral movement and execution technique.
Evidence tier is mixed. Exploitation is CONFIRMED by its addition to the CISA KEV catalog on 2024-07-30. The GPO-based attack vector is REPORTED by Microsoft. However, there is conflicting intelligence from a secondary source (cert.at) which associates active exploitation with a vulnerability in VMware ESXi. At present, the primary, confirmed threat is CVE-2024-37085 affecting Microsoft environments. The VMware report may refer to a separate, concurrent campaign or contain erroneous information.
Affected Systems
- Microsoft Windows (Inferred from GPO-based attack vector)
Intelligence Context
The addition of CVE-2024-37085 to the CISA KEV catalog mandates immediate attention from federal agencies and critical infrastructure. The high EPSS score (92.8th percentile) quantitatively supports CISA's assessment, indicating a high probability of exploitation activity. The absence of a CVSS score is unusual for a KEV entry and suggests the listing was driven purely by observed-in-the-wild attacks, prioritizing real-world risk over theoretical severity. Defenders should treat this as a confirmed, active threat. The 'PERSISTENT THREAT' label indicates the underlying attacker TTPs—specifically GPO abuse for ransomware deployment—are well-established, even if this CVE is the novel component enabling it.
Remediation & Defense
- Microsoft reports that predictive shielding in Microsoft Defender for Endpoint can prevent the associated ransomware execution. This is a compensating control, not a direct patch for the vulnerability.
- Monitor for unauthorized or anomalous modifications to Group Policy Objects (GPOs), particularly changes to logon scripts, scheduled tasks, or software installation policies.
- Audit Windows Event Logs (Security Log Event ID 5136) for GPO changes and correlate with change management records.
Source Timeline
- microsoft.com — First reporter
- cisa.gov/kev — Official exploitation confirmation
- cert.at — Secondary report with conflicting details