Threat reportVulnerabilityTL-2026-0776
BlueKeep (CVE-2019-0708) Windows RDP Use-After-Free Exploited In the Wild to Deploy Monero Cryptominer
CVE-2019-0708 (BlueKeep) is a pre-authentication, wormable use-after-free in the Windows Remote Desktop Services driver (termdd.sys). In early November 2019, Kryptos Logic and Kevin Beaumont confirmed the first in-the-wild exploitation: an opportunistic actor mass-scanned port 3389, fired a Metasploit-derived exploit, and used multi-stage encoded PowerShell to drop a Monero cryptominer onto unpatched Windows hosts.
Key facts for BlueKeep Monero cryptominer
| Identifiers | TL-2026-0776, CVE-2019-0708 |
|---|---|
| Also known as | BlueKeep |
| Severity | CRITICAL |
| CVSS | 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) |
| Exploitation status | Exploited in the wild; Listed in CISA KEV: CVE-2019-0708 (added ) |
| EPSS | CVE-2019-0708: 99.9% (99.9th percentile) |
| Affected products | Microsoft Windows 7; Microsoft Windows Server 2008 R2; Microsoft Windows Server 2008; Microsoft Windows XP / Windows Vista / Windows Server 2003 |
| Weaknesses (CWE) | CWE-416 |
| Malware | Monero cryptominer (XMR coinminer), WatchBog |
| Tools | Attacker-hosted HTTP staging server delivering stage-2 PowerShell + miner, Metasploit BlueKeep module (exploit/windows/rdp/cve_2019_0708_bluekeep_rce) |
| MITRE ATT&CK techniques | T1027 Obfuscated Files or Information, T1046 Network Service Discovery, T1059 Command and Scripting Interpreter, T1068 Exploitation for Privilege Escalation, T1071 Application Layer Protocol, T1105 Ingress Tool Transfer, T1106 Native API, T1133 External Remote Services, T1140 Deobfuscate/Decode Files or Information, T1190 Exploit Public-Facing Application, T1210 Exploitation of Remote Services, T1496 Resource Hijacking and 3 more in the attack flow |
| Motivation | FINANCIAL |
| Target sectors | any internet-exposed RDP host, small and medium business, healthcare, government, education |
| Target regions | Global |
| Detection rules | 9 (1 shown free) |
| Sources | 9 cited sources |
Detection coverage for BlueKeep Monero cryptominer
As of 2026-06-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0776 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: BlueKeep Exploitation — RDP/3389 Active Scanning + termdd.sys Bugcheck Correlation
Detects the exploitation footprint of CVE-2019-0708 (BlueKeep): a burst of inbound connections to TCP 3389 from a single source (active scanning / mass-exploitation of Remote Desktop Services) correlated with clustered Windows bugchecks whose faulting module is termdd.sys. Unreliable BlueKeep exploitation frequently corrupts kernel memory and bugchecks (BSOD) the target, so termdd.sys crashes on internet-exposed RDP hosts shortly after a scan spike are a high-fidelity exploitation indicator.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1190, T1595.002, T1046, T1499
- Data sources: firewall, windows_security, sysmon, wineventlog_system, edr_network
- Severity: critical
- Confidence: high
Splunk SPL
(index=network sourcetype=firewall OR sourcetype="pan:traffic" dest_port=3389 action=allowed) OR (index=wineventlog sourcetype="WinEventLog:System" SourceName="Microsoft-Windows-WER-SystemErrorReporting" "termdd.sys")
| eval rdp_scan=if(dest_port=3389,1,0)
| eval termdd_crash=if(searchmatch("termdd.sys"),1,0)
| bin _time span=5m
| stats dc(src_ip) AS distinct_sources sum(rdp_scan) AS rdp_conn_count sum(termdd_crash) AS termdd_bugchecks values(src_ip) AS src_ips BY _time dest_ip
| where rdp_conn_count>100 OR termdd_bugchecks>0
| eval risk=case(termdd_bugchecks>0 AND rdp_conn_count>100,"critical: scan spike + termdd bugcheck",termdd_bugchecks>0,"high: termdd.sys bugcheck on RDP host",true(),"medium: RDP scan spike")
| table _time dest_ip distinct_sources rdp_conn_count termdd_bugchecks src_ips riskMicrosoft KQL
let scan = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort == 3389 and ActionType == "InboundConnectionAccepted"
| summarize RdpConn = count(), Sources = dcount(RemoteIP) by DeviceId, bin(Timestamp, 5m)
| where RdpConn > 100;
let crash = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType in ("BugCheck", "SystemCrash") or AdditionalFields has "termdd.sys"
| summarize Bugchecks = count() by DeviceId, bin(Timestamp, 5m);
scan | join kind=fullouter crash on DeviceId
| project Timestamp = coalesce(Timestamp, Timestamp1), DeviceId = coalesce(DeviceId, DeviceId1), RdpConn, Sources, Bugchecks
| where RdpConn > 100 or Bugchecks > 0Sigma
title: BlueKeep Exploitation - RDP Scan Spike and termdd.sys Bugcheck
id: 6a1f2c84-7e3b-4d09-9b21-0708bluekeep01
status: experimental
description: Correlates high-volume inbound TCP 3389 connections with termdd.sys bugchecks indicative of CVE-2019-0708 (BlueKeep) exploitation attempts
references:
- https://www.kryptoslogic.com/blog/2019/11/bluekeep-cve-2019-0708-exploitation-spotted-in-the-wild/
- https://nvd.nist.gov/vuln/detail/CVE-2019-0708
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/11
tags:
- attack.initial_access
- attack.t1190
- attack.reconnaissance
- attack.t1595.002
- attack.impact
- attack.t1499
- cve.2019.0708
logsource:
product: windows
service: system
detection:
selection:
Provider_Name: 'Microsoft-Windows-WER-SystemErrorReporting'
Data|contains: 'termdd.sys'
condition: selection
falsepositives:
- Genuine termdd.sys driver faults from unrelated RDP stability bugs or buggy third-party RDP add-ons
level: highKnown false positives:
- Legitimate RDP gateway / load-balancer health checks generating many 3389 connections
- Genuine termdd.sys faults unrelated to BlueKeep (driver bugs, unstable RDP add-ons)
- Authorized vulnerability scanners sweeping RDP from a known source IP
Tuning notes: Tune the 100-connections-per-5min threshold to your environment's baseline RDP volume; allowlist authorized scanner and RDP-gateway source IPs. Raise severity when a termdd.sys bugcheck immediately follows a scan spike from the same external source.
- BlueKeep Exploitation — [indicator] Bugcheck / BSOD on Internet-Exposed RDP Host · unlock with TL Creds
- BlueKeep Post-Exploitation — RDP-Service-Spawned Encoded PowerShell (Defender) · unlock with TL Creds
- BlueKeep C2 — PowerShell Outbound Download Followed by Monero Miner Behavior · unlock with TL Creds
- BlueKeep Exploitation — Shellcode Signature Eggs + 0x170 Heap-Spray in Memory · unlock with TL Creds
- BlueKeep Post-Exploitation — Decoded Stager: Encoded PowerShell with Hidden/NoProfile Flags · unlock with TL Creds
- BlueKeep Impact — Monero Miner Ingress Transfer + Run-Key Persistence (Resource Hijacking) · unlock with TL Creds
- BlueKeep Post-Exploitation — Encoded PowerShell Stager from RDP Service Context · unlock with TL Creds
- BlueKeep C2 / Ingress Tool Transfer — PowerShell HTTP Download + Monero Miner Drop · unlock with TL Creds
Indicators of compromise for BlueKeep Monero cryptominer
As of 2026-06-11, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-0776.
Sample indicators (2 of 16)
- Domain:
termdd[.]sys - File hash:
8a87a1261603af4d976faa57e49ebdd8fd8317e9dd13bd36ff2599d1031f53ce
Defanged, TLP:CLEAR. Full set of 16 indicators: unlock with TL Creds.
How BlueKeep Monero cryptominer works
The campaign was unreliable, crashing many systems (BSOD) rather than reliably installing the miner.
BlueKeep (CVE-2019-0708) is a critical use-after-free vulnerability (CWE-416) in the Windows Remote Desktop Services / RDP kernel driver termdd.sys, disclosed and patched by Microsoft on 14 May 2019. The flaw resides in the handling of the MS_T120 internal virtual channel: by binding MS_T120 to a non-default channel number and then triggering its teardown, an unauthenticated attacker frees the channel structure while a dangling pointer to it remains, yielding a use-after-free that can be groomed into remote code execution in kernel context (NT AUTHORITY\SYSTEM). Exploitation requires no authentication and no user interaction over the network (CVSS 3.1 base 9.8; CVSS v2 base 10.0), and because RDP is widely exposed on TCP port 3389, Microsoft, the NSA, and CISA repeatedly warned the bug was 'wormable' and comparable to the SMB flaw behind WannaCry/NotPetya.
Reliable exploitation requires winning a kernel heap grooming race: the freed MS_T120 structure is 0x170 bytes, so working exploits (including the public Metasploit module) heap-spray thousands of 0x170-byte allocations — Kryptos Logic observed 19,000+ identical allocations consistent with heap spraying — to reclaim the freed hole with attacker-controlled data before the dangling pointer is reused. The exploit is notoriously fragile: incorrect grooming corrupts kernel memory and bugchecks the host, which is exactly what defenders observed in the wild.
The in-the-wild campaign was surfaced on 2 November 2019 when Kevin Beaumont's distributed BlueKeep honeypot network ('BluePot') began throwing Blue Screens of Death. Beaumont shared a crash dump with Marcus Hutchins (MalwareTech) at Kryptos Logic, who reverse-engineered it and found BlueKeep exploitation artifacts in kernel memory plus shellcode whose structure matched the Metasploit BlueKeep module. The shellcode used two distinctive signature 'eggs' for its kernel-to-usermode staging: a kernel-mode egg 0x0b00dac0fefe42069 and a usermode egg 0xb00dac0fefe31337. The final-stage shellcode launched an encoded PowerShell command, which in turn downloaded a second-stage PowerShell script from attacker infrastructure that retrieved and executed a Monero (XMR) cryptocurrency miner. The miner sample carried SHA-256 8a87a1261603af4d976faa57e49ebdd8fd8317e9dd13bd36ff2599d1031f53ce (≈44% VirusTotal detection on 3 Nov 2019; an associated sample was first uploaded to VirusTotal on 21 Oct 2019 from a Ukrainian IP). Honeypot crashes were retrospectively traced back to roughly 23 October 2019.
Analysts (Hutchins, Beaumont) assessed the operator as a low-skill, financially motivated actor opportunistically infecting internet-exposed hosts with off-the-shelf penetration-testing tooling rather than a sophisticated or worm-capable adversary — there was no self-propagation, and the exploit's poor reliability limited impact to denial-of-service-style crashes on many targets. The campaign is significant primarily as the proof that a long-feared, six-months-patched, pre-auth wormable RDP bug was finally being weaponized at scale, validating the urgency of the May 2019 emergency patches that even covered end-of-life Windows XP and Server 2003.
MITRE ATT&CK techniques by tactic:
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information
Discovery
T1046 Network Service Discovery
Execution
T1059 Command and Scripting Interpreter; T1106 Native API
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
Lateral Movement
T1210 Exploitation of Remote Services
Impact
T1496 Resource Hijacking; T1499 Endpoint Denial of Service
Resource Development
Reconnaissance
Remediation for BlueKeep Monero cryptominer
Patches
- KB4499175
- KB4499164
- KB4499180
- KB4499149
- KB4500331
Immediate actions
- Apply Microsoft's May 2019 RDP RCE patches (KB4499175/KB4499164 for Windows 7 & Server 2008 R2; KB4499180/KB4499149 for Server 2008; KB4500331 for Windows XP/Vista/Server 2003) to every affected host.
- Block or restrict inbound TCP 3389 (RDP) at the network perimeter; never expose RDP directly to the internet.
- Hunt for the miner SHA-256 8a87a1261603af4d976faa57e49ebdd8fd8317e9dd13bd36ff2599d1031f53ce and for unexpected encoded PowerShell child processes of svchost/RDP services.
Workarounds
- Enable Network Level Authentication (NLA) to block the unauthenticated trigger.
- Disable Remote Desktop Services where it is not required.
- Restrict RDP to trusted source IPs via host/perimeter firewall.
Longer-term hardening
- Deploy EDR with behavioral detection for encoded PowerShell, ingress tool transfer, and cryptomining resource-hijacking behavior.
- Enforce Network Level Authentication (NLA) on all RDP endpoints to require authentication before the vulnerable pre-auth code path is reached.
- Put all remote access behind a VPN or zero-trust gateway with MFA; segment and monitor east-west RDP.
Affected and fixed versions
- Microsoft — Windows 7
Vulnerable versions: 7 SP1 (x86); 7 SP1 (x64)
Fixed in: KB4499175; KB4499164 - Microsoft — Windows Server 2008 R2
Vulnerable versions: 2008 R2 SP1 (x64)
Fixed in: KB4499175; KB4499164 - Microsoft — Windows Server 2008
Vulnerable versions: 2008 SP2 (x86); 2008 SP2 (x64)
Fixed in: KB4499180; KB4499149 - Microsoft — Windows XP / Windows Vista / Windows Server 2003
Vulnerable versions: XP SP3; Vista SP2; Server 2003 SP2; Server 2003 R2
Fixed in: KB4500331
Timeline of BlueKeep Monero cryptominer
- Microsoft releases emergency patches for CVE-2019-0708 (BlueKeep), including out-of-support Windows XP and Server 2003, warning the RDP flaw is wormable.
- The U.S. National Security Agency issues an advisory urging immediate patching, warning BlueKeep could enable self-propagating worms comparable to WannaCry and NotPetya.
- Sophos publishes a working proof-of-concept exploit to underscore the urgency of patching.
- The locked-ioc-16 cryptomining malware is found to have incorporated a BlueKeep scanning module, mapping vulnerable RDP hosts ahead of exploitation.
- Rapid7 releases a public Metasploit module for BlueKeep; it is initially unreliable and prone to crashing targets.
- A BlueKeep cryptominer-related sample is first uploaded to VirusTotal from a Ukrainian IP address.
- Kevin Beaumont's BlueKeep honeypot network begins experiencing crashes, later traced to in-the-wild exploitation attempts.
- Mass Blue Screens of Death across Beaumont's 'BluePot' honeypots confirm the first large-scale in-the-wild BlueKeep exploitation; a crash dump is shared with Kryptos Logic.
- Marcus Hutchins / Kryptos Logic publish analysis confirming BlueKeep exploitation delivering a Monero cryptominer via multi-stage encoded PowerShell, with shellcode matching the Metasploit module.
- Microsoft publicly confirms active BlueKeep exploitation in the wild and renews its call for immediate patching.
- CISA adds CVE-2019-0708 to the Known Exploited Vulnerabilities Catalog, mandating remediation by federal agencies.
Sources cited for BlueKeep Monero cryptominer
- NVD - CVE-2019-0708 NVD (NIST) · Advisory · 2019-05-16
- CISA Known Exploited Vulnerabilities Catalog - CVE-2019-0708 CISA · Government advisory · 2021-11-03
- BlueKeep (CVE-2019-0708) Exploitation Spotted in the Wild kryptoslogic.com · Research · 2019-11-03
- CVE-2019-0708: BlueKeep Exploited in the Wild to Deliver Cryptocurrency Miner Tenable · Vendor report · 2019-11-04
- Microsoft Security Advisory CVE-2019-0708 (Remote Desktop Services RCE) Microsoft Security Response Center · Vendor report · 2019-05-14
- BlueKeep - Wikipedia (timeline of events) en.wikipedia.org · Blog · 2019-11-08
- BlueKeep Attacks Arrive, Bearing Cryptomining Malware bankinfosecurity.com · News · 2019-11-04
- Attackers attempt large-scale BlueKeep exploit to spread cryptominer (SC Media) scworld.com · News · 2019-11-04
- BlueKeep Scanner Discovered in Watchbog Cryptomining Malware BleepingComputer · News · 2019-07-25
Other reports on CVE-2019-0708
- Advanced (Targeted) Ransomware Attacks - SI-CERT Analysis (CVE-2020-0688, BlueKeep RDP)
- BlueKeep (CVE-2019-0708) RDP exploitation observed in the wild delivering cryptocurrency miner
- September 2026 APT Group Threat Report (AhnLab ASEC): DPRK, China, Russia, Iran/Pakistan-linked activity incl. supply-chain and legitimate-service C2 abuse
- September 2026 CVE Landscape: 94 high-impact vulnerabilities, NetScaler zero-days CVE-2026-88771/CVE-2026-88772, AI-agent-assisted exploitation
- NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on Exchange, Exploits BlueKeep (CVE-2019-0708) and DCSync to Compromise Russian Active Directory
- LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S. Bancorp)
Previous and next in vulnerability
Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.
