CVSS 8.1 HIGH Bulletin: Microsoft Patch Tuesday Published: 2024-02-13

CVE-2024-21412: Microsoft Windows SmartScreen Defense Evasion Vulnerability

Technical intelligence and weaponization dossier for CVE-2024-21412. Documented exploitation across 2 active malware families totaling 1,290 analyzed telemetry samples.

Attributed Families

Sample Volume

1,290

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Official NIST NVD

View NVD Record →

Vulnerability Specifications & Root Cause

Vulnerability ID	CVE-2024-21412
Common Name / Bulletin	Microsoft Windows SmartScreen Defense Evasion Vulnerability (`Microsoft Patch Tuesday`)
CWE Classification	`CWE-863: Incorrect Authorization / Defense Evasion in SmartScreen`
Affected Software & Versions	Microsoft Windows 10, 11, Server 2008 through 2022
Technical Root Cause	Bypass of Microsoft CVE-2023-36025 patch via nested internet shortcut (.url) files inside Microsoft Word or PDF documents pointing to WebDAV shares, weaponized zero-day by Water Hydra and DarkGate.
Associated ATT&CK Techniques	`T1204.002` — Associated ATT&CK Technique `T1566.002` — Associated ATT&CK Technique `T1553.005` — Associated ATT&CK Technique

Malware Families Weaponizing CVE-2024-21412

Empirical catalog telemetry verifies that the following 2 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:

2 families

Malware Family	Category	Catalog Samples	Operational Profile
darkgate	Loader	`1,205`	DarkGate is an evasive, commercial Malware-as-a-Service (MaaS) loader and remote access platform developed by a cybercriminal known as 'RastaFarEye'. Active pri...
lumma	Infostealer	`85`	Lumma Stealer (also tracked in threat telemetry as LummaC2, LummaStealer, and Trojan:Win32/Lumma) is a premier C-language information stealer that emerged in la...

Attributed Threat Actors & Syndicates

Threat intelligence confirms the following adversaries weaponize CVE-2024-21412 in enterprise intrusions and campaign toolkits:

MaaS Affiliates — Attributed Threat Group / Campaign Operator
RastaFarEye — Attributed Threat Group / Campaign Operator

SOC Detection & Threat Hunting Guidance

Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2024-21412 in enterprise networks:

File creation of .url shortcuts pointing to external WebDAV URLs with nested search-ms: parameters; zero SmartScreen prompt events logged for remote execution.

Remediation & Defensive Hardening

SOC containment checklist and attack surface reduction measures to neutralize exploitation:

Actionable Guidance: Apply Feb 2024 Windows cumulative update; enforce Windows Defender Application Control (WDAC) to restrict script execution from internet zones.

For end-to-end incident response procedures, consult our dedicated playbook: InfoStealer Protection & Remediation →

← Return to Vulnerability Matrix Directory (All 63 CVEs)