Threat reportVulnerabilityTL-2026-3836
BlueKeep (CVE-2019-0708) RDP exploitation observed in the wild delivering cryptocurrency miner
BlueKeep (CVE-2019-0708) RDP exploitation observed in the (TL-2026-3836), also tracked as BlueKeep, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-17. It has no confirmed attribution, affects Microsoft Windows 7, references 1 CVE (CVE-2019-0708), maps to 9 MITRE ATT&CK techniques (T1027, T1036.005, T1053.005), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 9MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-3836
- Threat ID
- TL-2026-3836
- Also known as
- BlueKeep, BlueKeep Monero Miner
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, health
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
Malware and tooling in BlueKeep (CVE-2019-0708) RDP exploitation observed in the
Malware and tooling: Monero Miner, Metasploit Framework (BlueKeep module), metasploit
How BlueKeep (CVE-2019-0708) RDP exploitation observed in the works
Kryptos Logic, working with researchers Kevin Beaumont and Marcus Hutchins, confirmed the first in-the-wild exploitation of the BlueKeep RDP use-after-free vulnerability (CVE-2019-0708) on 2019-11-02. The shellcode matched the BlueKeep Metasploit module and led to a multi-stage encoded PowerShell chain that installed a Monero cryptocurrency miner.
CVE-2019-0708 (BlueKeep) is an unauthenticated remote code execution vulnerability in Windows Remote Desktop Services (formerly Terminal Services), reachable over RDP on TCP/3389 before authentication. It affects Windows 7 SP1, Windows Server 2008 SP2 and Windows Server 2008 R2 SP1 (NVD). Microsoft patched it on 2019-05-14 and warned that it was wormable. NVD scores it CVSS 3.1 9.8 (CWE-416, use-after-free), and CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03.
Exploit mechanics, per Kryptos Logic analysis of a kernel crash dump from Kevin Beaumont's 'EternalPot' RDP honeypots: the MS_T120 virtual channel structure is freed while a dangling pointer remains in the RDP driver (termdd.sys). The exploit heap-sprays the kernel pool with a very large number of allocations (19,000+, versus fewer than 100 in normal use). Attacker allocations of 0x170 bytes (channel structure plus metadata) reclaim the freed object, and a function pointer at offset 0x100 is overwritten to redirect execution. Kryptos Logic reported that the shellcode matched the public BlueKeep Metasploit module. Kernel shellcode locates the usermode stage with an egg hunt (egg 0x0b00dac0fefe42069 as reported), and the usermode shellcode (egg 0xb00dac0fefe31337 as reported) launches the payload.
Post-exploitation, per Microsoft's analysis: the initial encoded PowerShell command downloaded a further encoded PowerShell script from 5.135.199.19 (France) over port 443. Several nested encoded PowerShell stages followed, and the final stage downloaded a coin miner executable, written to C:\Windows\System32\spool\svchost.exe, from 109.176.117.11 (Great Britain). The miner contacted a command-and-control server at 5.100.251.106 (Israel), and the final script created a scheduled task to keep the miner persistent. Microsoft also found that an earlier coin-mining campaign in September 2019 used a main implant that contacted the same C2 infrastructure as the October BlueKeep Metasploit campaign. The miner was detected by 44% of VirusTotal engines as of 2019-11-03 (Tenable).
The exploit was unreliable and often crashed targets with a BSOD instead of delivering the payload. Microsoft Defender ATP behavioral telemetry showed RDP-related crashes rising from about 10 to about 100 per day starting 2019-09-06, which coincides with the Metasploit module release. Crashes were seen on external researcher honeypots from 2019-10-23. Kryptos Logic saw no WannaCry-style indiscriminate mass scanning and attributed the activity to a likely 'low-level actor' using out-of-the-box penetration-testing utilities. No named group is attributed. The delay of about six months between patch and detectable weaponization was noted as unexplained.
MITRE ATT&CK techniques used in TL-2026-3836
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1203 Exploitation for Client Execution
Command and Control
T1071.001 Application Layer Protocol: Web Protocols
Initial Access
T1190 Exploit Public-Facing Application
Impact
Affected products and versions in BlueKeep (CVE-2019-0708) RDP exploitation observed in the
- Microsoft — Windows 7
Vulnerable versions: Windows 7 SP1 (32-bit and x64)
Fixed in: May 2019 security update (MSRC CVE-2019-0708) - Microsoft — Windows Server 2008
Vulnerable versions: Windows Server 2008 SP2 (32-bit, x64); Windows Server 2008 R2 SP1 (x64, Itanium)
Fixed in: May 2019 security update (MSRC CVE-2019-0708) - Siemens — Medical imaging equipment running affected Windows versions
Vulnerable versions: See Siemens advisories referenced in NVD - Huawei — Servers and storage systems running affected Windows versions
Vulnerable versions: See Huawei security notices referenced in NVD
Remediation for BlueKeep (CVE-2019-0708) RDP exploitation observed in the
Patches
- Microsoft security advisory CVE-2019-0708 (released 2019-05-14) for Windows 7, Server 2008 and Server 2008 R2; out-of-band fixes were also issued for Vista, XP and Server 2003 per Tenable
Immediate actions
- Apply the Microsoft security update for CVE-2019-0708 on all affected Windows 7, Server 2008 and Server 2008 R2 hosts
- Block inbound TCP/3389 at the network perimeter and do not expose RDP directly to the internet
- Enable Network Level Authentication (NLA) on RDP hosts
- Block 5.135.199.19, 109.176.117.11 and 5.100.251.106 at the perimeter and hunt for historical connections
- Hunt for C:\Windows\System32\spool\svchost.exe and for scheduled tasks launching encoded PowerShell
Workarounds
- Enable NLA, which forces authentication before the vulnerable code path is reached
- Disable Remote Desktop Services where it is not needed
- Block TCP/3389 at the firewall
Longer-term hardening
- Upgrade or retire end-of-life Windows systems
- Disable unused services such as Remote Desktop where not required
- Alert on unexplained RDP-service crashes or BSODs on RDP-enabled hosts as a possible exploitation signal
- Deploy EDR with behavioral detection for encoded PowerShell and coin-miner activity
CVEs associated with BlueKeep (CVE-2019-0708) RDP exploitation observed in the
Weaknesses (CWE) in BlueKeep (CVE-2019-0708) RDP exploitation observed in the
Timeline of BlueKeep (CVE-2019-0708) RDP exploitation observed in the
- Microsoft releases the security update for CVE-2019-0708 (BlueKeep) and warns the flaw is wormable.
- CVE-2019-0708 published in NVD with CVSS 3.1 base score 9.8 (CWE-416).
- BlueKeep Metasploit module released; Microsoft Defender ATP telemetry shows RDP-related crashes rising from about 10 to about 100 per day. An earlier September coin-mining campaign used a main implant that contacted the same C2 later seen in the BlueKeep campaign.
- Microsoft observes memory-corruption crashes consistent with BlueKeep exploit attempts.
- Crashes are detected on external researcher RDP honeypots.
- Kevin Beaumont's EternalPot RDP honeypots begin crashing with BSODs; a kernel dump is shared with Marcus Hutchins, who confirms the first in-the-wild BlueKeep exploitation.
- Kryptos Logic publishes its analysis: BlueKeep Metasploit shellcode, multi-stage encoded PowerShell chain and a cryptocurrency miner payload (SHA-256 8a87a126...53ce).
- Microsoft publishes its analysis of the attacks, naming the three-server infrastructure, the scheduled-task persistence and the miner path, and releasing Defender ATP threat analytics and advanced hunting queries.
- CISA adds CVE-2019-0708 to the Known Exploited Vulnerabilities catalog (remediation due 2022-05-03).
Sources cited for BlueKeep (CVE-2019-0708) RDP exploitation observed in the
- BlueKeep (CVE 2019-0708) exploitation spotted in the wild
- The new CVE-2019-0708 RDP exploit attacks explained (Microsoft Security Blog)
- NVD - CVE-2019-0708
- Microsoft MSRC Advisory CVE-2019-0708
- CISA Known Exploited Vulnerabilities Catalog (CVE-2019-0708)
- CVE-2019-0708: BlueKeep Exploited in the Wild to Deliver Cryptocurrency Miner (Tenable)
- BlueKeep vulnerability exploited to deliver cryptocurrency miner (SecurityWeek)
- Microsoft urges us to patch after partially effective BlueKeep attack (Sophos News)
- Microsoft Connects BlueKeep to Coin-Mining Attacks (MCPmag)
- BlueKeep Exploits Used for Coin Mining (Redmondmag)
Detection coverage for TL-2026-3836
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3836 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.