# BlueKeep (CVE-2019-0708) RDP exploitation observed in the wild delivering cryptocurrency miner

> Kryptos Logic, working with researchers Kevin Beaumont and Marcus Hutchins, confirmed the first in-the-wild exploitation of the BlueKeep RDP use-after-free vulnerability (CVE-2019-0708) on 2019-11-02. The shellcode matched the BlueKeep Metasploit module and led to a multi-stage encoded PowerShell chain that installed a Monero cryptocurrency miner.

- **Published:** 2026-10-17T20:18:26Z
- **Last reviewed:** 2026-10-17T20:18:26Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3836
- **ID:** TL-2026-3836
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2019-0708

## Description

CVE-2019-0708 (BlueKeep) is an unauthenticated remote code execution vulnerability in Windows Remote Desktop Services (formerly Terminal Services), reachable over RDP on TCP/3389 before authentication. It affects Windows 7 SP1, Windows Server 2008 SP2 and Windows Server 2008 R2 SP1 (NVD). Microsoft patched it on 2019-05-14 and warned that it was wormable. NVD scores it CVSS 3.1 9.8 (CWE-416, use-after-free), and CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03.

Exploit mechanics, per Kryptos Logic analysis of a kernel crash dump from Kevin Beaumont's 'EternalPot' RDP honeypots: the MS_T120 virtual channel structure is freed while a dangling pointer remains in the RDP driver (termdd.sys). The exploit heap-sprays the kernel pool with a very large number of allocations (19,000+, versus fewer than 100 in normal use). Attacker allocations of 0x170 bytes (channel structure plus metadata) reclaim the freed object, and a function pointer at offset 0x100 is overwritten to redirect execution. Kryptos Logic reported that the shellcode matched the public BlueKeep Metasploit module. Kernel shellcode locates the usermode stage with an egg hunt (egg 0x0b00dac0fefe42069 as reported), and the usermode shellcode (egg 0xb00dac0fefe31337 as reported) launches the payload.

Post-exploitation, per Microsoft's analysis: the initial encoded PowerShell command downloaded a further encoded PowerShell script from 5.135.199.19 (France) over port 443. Several nested encoded PowerShell stages followed, and the final stage downloaded a coin miner executable, written to C:\Windows\System32\spool\svchost.exe, from 109.176.117.11 (Great Britain). The miner contacted a command-and-control server at 5.100.251.106 (Israel), and the final script created a scheduled task to keep the miner persistent. Microsoft also found that an earlier coin-mining campaign in September 2019 used a main implant that contacted the same C2 infrastructure as the October BlueKeep Metasploit campaign. The miner was detected by 44% of VirusTotal engines as of 2019-11-03 (Tenable).

The exploit was unreliable and often crashed targets with a BSOD instead of delivering the payload. Microsoft Defender ATP behavioral telemetry showed RDP-related crashes rising from about 10 to about 100 per day starting 2019-09-06, which coincides with the Metasploit module release. Crashes were seen on external researcher honeypots from 2019-10-23. Kryptos Logic saw no WannaCry-style indiscriminate mass scanning and attributed the activity to a likely 'low-level actor' using out-of-the-box penetration-testing utilities. No named group is attributed. The delay of about six months between patch and detectable weaponization was noted as unexplained.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1071.001 Application Layer Protocol: Web Protocols
- T1496.001 Resource Hijacking: Compute Hijacking

## Sources

- [BlueKeep (CVE 2019-0708) exploitation spotted in the wild](https://www.kryptoslogic.com/blog/2019/11/bluekeep-cve-2019-0708-exploitation-spotted-in-the-wild/)
- [The new CVE-2019-0708 RDP exploit attacks explained (Microsoft Security Blog)](https://www.microsoft.com/en-us/security/blog/2019/11/07/the-new-cve-2019-0708-rdp-exploit-attacks-explained/)
- [NVD - CVE-2019-0708](https://nvd.nist.gov/vuln/detail/CVE-2019-0708)
- [Microsoft MSRC Advisory CVE-2019-0708](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708)
- [CISA Known Exploited Vulnerabilities Catalog (CVE-2019-0708)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [CVE-2019-0708: BlueKeep Exploited in the Wild to Deliver Cryptocurrency Miner (Tenable)](https://www.tenable.com/blog/cve-2019-0708-bluekeep-exploited-in-the-wild-to-deliver-cryptocurrency-miner)
- [BlueKeep vulnerability exploited to deliver cryptocurrency miner (SecurityWeek)](https://www.securityweek.com/bluekeep-vulnerability-exploited-deliver-cryptocurrency-miner)
- [Microsoft urges us to patch after partially effective BlueKeep attack (Sophos News)](https://news.sophos.com/en-us/2019/11/11/microsoft-urges-us-to-patch-after-partially-effective-bluekeep-attack/)
- [Microsoft Connects BlueKeep to Coin-Mining Attacks (MCPmag)](https://mcpmag.com/Articles/2019/11/08/Microsoft-BlueKeep-Coin-Mining.aspx)
- [BlueKeep Exploits Used for Coin Mining (Redmondmag)](https://redmondmag.com/Articles/2019/11/07/BlueKeep-Exploits-Used-for-Coin-Mining.aspx)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3836