Bryce Abdo

**Name of the Vulnerable Software and Affected Versions** Windows DWM Core Library (affected versions not specified) **Description** The issue is related to an elevation of privilege vulnerability in the Windows DWM Core Library. This vulnerability allows attackers to affect the system. It has been linked to cyberattacks involving QakBot, a notorious banking trojan. The vulnerability is being actively exploited by QakBot and other malware. Researchers have identified a new zero-day vulnerability in Windows, designated as this issue, and it is being used by multiple attackers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft MSHTML (affected versions not specified) **Description** A remote code execution issue exists in the MSHTML browser rendering engine used by Microsoft Windows and Microsoft Office. The flaw is caused by incorrect code generation management. A remote attacker can exploit this by crafting a malicious ActiveX control embedded within a specially designed Microsoft Office document. When a user is convinced to open the document, the attacker can execute arbitrary code on the system. Users with administrative rights are more significantly impacted than those with limited user rights. Real-world exploitation has been observed in targeted attacks, including the deployment of "MerkSpy" spyware and activities by state-sponsored groups such as APT 35 (Magic Hound) and APT 28 (Fancy Bear). Some attack chains have utilized distorted RAR archives containing Windows Script Host scripts to deliver the malicious Word documents. **Recommendations** Install the security updates released on September 14, 2021, immediately. For enterprise customers managing updates, deploy Microsoft Defender detection build 1.349.22.0 or newer. Keep antimalware products up to date to ensure detection and protection.