Technical intelligence and weaponization dossier for CVE-2018-0886. Documented exploitation across 1 active malware families totaling 2,992 analyzed telemetry samples.
| Vulnerability ID | CVE-2018-0886 |
|---|---|
| Common Name / Bulletin | Microsoft CredSSP Remote Code Execution Vulnerability (Microsoft Patch Tuesday) |
| CWE Classification | CWE-287: Improper Authentication in CredSSP |
| Affected Software & Versions | Microsoft Windows 7, 8.1, 10, Server 2008 through 2016 |
| Technical Root Cause | Man-in-the-middle cryptographic downgrade vulnerability in Credential Security Support Provider protocol (CredSSP) during RDP sessions. |
| Associated ATT&CK Techniques |
|
Empirical catalog telemetry verifies that the following 1 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| gandcrab | Ransomware | 2,992 | GandCrab is a landmark ransomware family that revolutionized the modern cyber extortion industry by pioneering and popularizing the Ransomware-as-a-Service (Raa... |
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2018-0886 in enterprise networks:
RDP connection failures logging Event ID 1067 with CredSSP encryption oracle remediation mismatch.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Ransomware Containment & Incident Response →