Researchers spot the first successful attack using Windows BlueKeep vulnerability; the exploit is not a worm and installs cryptominers, instead of ransomware
Using Firepower to defend against encrypted DejaBlue Jon Fingas / Engadget : The first in-the-wild BlueKeep cyberattack isn't as dangerous as feared Elizabeth Montalbano / Threatpost : BlueKeep Attacks Have Arrived, Are Initially Underwhelming Davey Winder / Forbes : Windows ‘BlueKeep’ Attack That U.S. Government Warned About Is Happening Right Now Keumars Afifi-Sabet / IT PRO : First mass BlueKeep exploitation spotted in the wild EditorDavid / Slashdot : A Widespread BlueKeep ‘Exploit’ Is Targetting Unpatched Windows 7/XP Computers Shaun Nichols / The Register : Chrome bug squashed, QNAP NAS nasty hits, BlueKeep malware spreads, and more Eduard Kovacs / SecurityWeek : BlueKeep Vulnerability Exploited to Deliver Cryptocurrency Miner Ed Targett / Computer Business Review : BlueKeep Malware Lands, Spawns, Vanishes Abruptly Raka / MSPoweruser : BlueKeep attacks go live, but it isn't as dangerous as feared Duncan Riley / SiliconANGLE : Attack targeting Microsoft RDP ‘BlueKeep’ vulnerability spotted in the wild Jon Fingas / Yahoo Finance : The first in-the-wild BlueKeep attack isn't as dangerous as feared Pierluigi Paganini / Security Affairs : First Cyber Attack ‘Mass Exploiting’ BlueKeep RDP Flaw Spotted in the Wild The Hacker News : First Cyber Attack ‘Mass Exploiting’ BlueKeep RDP Flaw Spotted in the Wild Woody / AskWoody : BlueKeep now being used in attacks - but the sky isn't falling Tweets: Kevin Beaumont / @gossithedog : Since publishing, all BlueKeep activity that I could see has stopped. Alyssa Miller / @alyssam_infosec : The discovery of this by @GossiTheDog and @MalwareTechBlog has been fascinating to watch but also terrifying. BlueKeep seems to be the gift that keeps on giving for attackers. @MalwareJake thanks for your analysis as well. https://www.zdnet.com/...
Context & Ripple Effects
The arc here is one of escalating availability followed by a muted detonation: researchers found roughly a million older Windows devices exposed to the wormable RDP flaw in May, Immunity began selling a working BlueKeep exploit to pen-testers in July, and Metasploit put an exploit on GitHub in September — removing the last technical barrier for anyone scanning port 3389.
What changed this week is proof of use: the first mass exploitation has arrived, but instead of the self-propagating worm the government warning implied, attackers are installing cryptominers on unpatched machines, and activity is described as initially underwhelming. It matters because BlueKeep was the test case for whether a post-WannaCry-style RDP worm would actually materialize — and so far the answer from the field is no.
First-order effects
- Operators of unpatched Windows 7/XP machines are now being compromised at scale, but the payload is cryptomining — victims lose compute cycles and electricity rather than files, and most won't notice the intrusion itself.
- Defenders and researchers monitoring the threat get their first ground-truth read on BlueKeep's real-world behavior: no worming observed, monetization via mining, and activity that has largely tapered off.
Second-order effects
- Microsoft's August patches for four additional wormable Remote Desktop bugs now look prescient — organizations that treated BlueKeep as a one-flaw fix have adjacent DejaBlue-class exposure sitting behind the same open RDP ports.
- With the exploit public and proven in the wild, security vendors shift messaging from worm-preparedness to baseline hygiene: closing or segmenting RDP becomes table stakes, pressuring laggards who kept legacy Windows boxes internet-facing after the original warnings.
Third-order effects
- If the pattern holds — public Metasploit releases and commercial exploit sales reliably producing in-the-wild use but not automatic worms — the industry's threat model for wormable CVEs shifts from 'assume pandemic' to 'assume steady-state criminal harvesting of the unpatched long tail'.
- Legacy Windows estates become a structural liability that outlives any single patch cycle: the same exposed-RDP population that made BlueKeep viable remains the standing target for every future remote code execution bug Microsoft ships fixes for.
The trend: Wormable infrastructure vulnerabilities are converging on a lifecycle where disclosure, commercial exploit markets, and public Metasploit tooling guarantee eventual criminal exploitation — typically for low-yield payloads like cryptomining — while the feared self-propagating worm stays the exception.