CVSS 8.8 HIGH Bulletin: Microsoft Patch Tuesday Published: 2023-11-14

CVE-2023-36025: Microsoft Windows SmartScreen Security Feature Bypass

Technical intelligence and weaponization dossier for CVE-2023-36025. Documented exploitation across 1 active malware families totaling 1,205 analyzed telemetry samples.

Attributed Families

Sample Volume

1,205

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Official NIST NVD

View NVD Record →

Vulnerability Specifications & Root Cause

Vulnerability ID	CVE-2023-36025
Common Name / Bulletin	Microsoft Windows SmartScreen Security Feature Bypass (`Microsoft Patch Tuesday`)
CWE Classification	`CWE-863: Incorrect Authorization in Shell Shortcut Processing`
Affected Software & Versions	Microsoft Windows 10, 11, Server 2008 through 2022
Technical Root Cause	Flaw in Windows SmartScreen processing internet shortcut (.url) files pointing to malicious WebDAV shares, completely suppressing Mark-of-the-Web (MOTW) warnings. Weaponized by DarkGate.
Associated ATT&CK Techniques	`T1204.002` — Associated ATT&CK Technique `T1566.002` — Associated ATT&CK Technique `T1553.005` — Associated ATT&CK Technique

Malware Families Weaponizing CVE-2023-36025

Empirical catalog telemetry verifies that the following 1 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:

1 families

Malware Family	Category	Catalog Samples	Operational Profile
darkgate	Loader	`1,205`	DarkGate is an evasive, commercial Malware-as-a-Service (MaaS) loader and remote access platform developed by a cybercriminal known as 'RastaFarEye'. Active pri...

Attributed Threat Actors & Syndicates

Threat intelligence confirms the following adversaries weaponize CVE-2023-36025 in enterprise intrusions and campaign toolkits:

MaaS Affiliates — Attributed Threat Group / Campaign Operator
RastaFarEye — Attributed Threat Group / Campaign Operator

SOC Detection & Threat Hunting Guidance

Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2023-36025 in enterprise networks:

Sysmon Event ID 11: File creation of .url internet shortcut files referencing search-ms: or WebDAV paths (\\IP@port\) bypassing SmartScreen dialogs.

Remediation & Defensive Hardening

SOC containment checklist and attack surface reduction measures to neutralize exploitation:

Actionable Guidance: Install Nov 2023 Windows cumulative update; block outbound SMB/WebDAV connections to external untrusted IPs.

For end-to-end incident response procedures, consult our dedicated playbook: Active Incident Response Playbook →

← Return to Vulnerability Matrix Directory (All 63 CVEs)