BlueKeep exploit found in the wild

By Dylan Bushell-Embling
Tuesday, 05 November, 2019

BlueKeep exploit found in the wild

The infamous BlueKeep Microsoft vulnerability is now being actively exploited, according to Kevin Beaumont, the security researcher who named it.’s Beaumont revealed that honeypot servers he had set up to detect exploitation of BlueKeep had done their job in a big way.

Starting on 24 October, Beaumont discovered that the honeypots he had set up were crashing and rebooting. In the intervening time, all the servers — excluding one in Australia — were doing so with increasing frequency.

Analysis indicated that the honeypot servers had been injected with a cryptocurrency miner using the BlueKeep exploit method. Beaumont said all but the Australian server show signs of being compromised using BlueKeep exploits, normally several times a day.

While the attack itself is not too concerning as coin miners are not a big threat, it does indicate that attackers are coming to understand how to use BlueKeep to execute attacks on random targets, and are starting to do so.

Tenable Senior Research Engineer Satnam Narang agreed that the discovery should be cause for concern.

“This is the first example of attackers exploiting the BlueKeep vulnerability in the wild, which should set alarm bells off for organisations that have yet to patch vulnerable systems,” he said.

“According to BinaryEdge, there are over 700,000 vulnerable systems that are publicly accessible, including over 4500 in Australia. The risks here cannot be overstated —  organisations must patch their systems immediately."

But in a recent tweet, Beamont said since publishing the details of the attack, all exploit activity targeting the honeypot servers appears to have stopped.

BlueKeep was first weaponised in September after an exploit using the vulnerability was released on the Rapid7-led Metasploit project

Image credit: ©

Related Articles

Privacy International urges Google to crack down on Android security

Privacy International has released a petition, calling on Google to help fight vulnerabilities in...

Microsoft patches serious PKI vulnerability

Microsoft has patched a PKI spoofing vulnerability considered so severe that the US NSA took the...

Best of 2019: Email providers' phishing nets have "big holes"

Across the festive season we'll be reprising some of our best articles from 2019. Today we...

  • All content Copyright © 2020 Westwick-Farrow Pty Ltd