Affected Systems
Windows systems with PowerShell and Windows Terminal enabled. Targets organizations with Active Directory environments. Attack vector: compromised websites displaying fake Cloudflare CAPTCHA prompts.
Exploitation Status
Active exploitation confirmed by Microsoft. Attacks observed in the wild. No hands-on post-compromise activity documented yet, but infrastructure is operational and capable of lateral movement.
Business Impact
Attackers gain persistent reverse tunnel access into internal networks, enabling reconnaissance of domain controllers, databases, backup servers, and mail systems. Compromised endpoints become network pivots for lateral movement. Risk of credential theft, privilege escalation, security tool disablement, data exfiltration, and ransomware deployment. Persistence established via scheduled tasks (hourly execution) and Registry Run keys.
Urgency
🟠Within 24 hours
Recommended Actions
- Restrict PowerShell execution via AppLocker or Windows Defender Application Control; enable Script Block Logging and Module Logging for all PowerShell activity
- Monitor and alert on LockScreenContentServer.exe executing outside its legitimate Windows system path (C:\Windows\SystemApps\*)
- Block outbound WebSocket connections to gitnow[.]dev:443 and monitor for unusual outbound connections on port 443 with SOCKS5 proxy behavior
- Hunt for scheduled tasks and Registry Run keys created within the past 30 days that execute obfuscated scripts or load unsigned DLLs
- If compromise confirmed, rotate all credentials accessible from infected hosts including domain admin accounts, and investigate for lateral movement to domain controllers, databases, and backup infrastructure