Windows Firewall Archives

Winsage

September 23, 2026

PAYLOAD ransomware hijacks Windows Group Policy in encryption-less attacks

A sophisticated PAYLOAD ransomware attack targeted an unnamed manufacturing organization in the Middle East, exploiting vulnerabilities in Microsoft Active Directory Group Policy. The attackers accessed the network through a compromised domain account via FortiGate SSL VPN on April 11, escalated privileges to domain administrator by April 13, and created a malicious Group Policy Object (GPO) named "PAYLOAD." This GPO was linked at the root of the domain, allowing it to affect nearly all domain-joined Windows workstations. The attackers distributed ransom notes, altered desktop images, displayed ransom messages at login, and disabled local administrator accounts. A second GPO, "win Firewall Off," was deployed to disable Windows Firewall across all profiles. The malicious policies activated on April 14 after systems were rebooted, causing widespread disruption. The attackers also exfiltrated data from file servers and published it on the dark web, while Kaspersky found no evidence of Windows file encryption or active malware processes. Recommendations for organizations include monitoring GPO creation, checking for unexpected changes, implementing multi-factor authentication for VPN access, and protecting privileged accounts.

Winsage

September 22, 2026

PAYLOAD ransomware hijacks Windows Group Policy in encryption-less attacks

A sophisticated PAYLOAD ransomware attack targeted a manufacturing organization in the Middle East, exploiting vulnerabilities in Microsoft Active Directory Group Policy. The attackers gained initial access on April 11 by compromising a domain account through the company's FortiGate SSL VPN. By April 13, they escalated privileges to a domain administrator and created a malicious Group Policy Object (GPO) named “PAYLOAD,” which was linked at the root of the domain. This GPO allowed them to distribute a ransom note, change desktop images, display a ransom message during login, and disable the local administrator account. A secondary GPO, “win Firewall Off,” was used to disable Windows Firewall across all profiles. The malicious changes activated on April 14 after system reboots, causing widespread disruption. The attackers also exfiltrated sensitive data, which was later released on the dark web. Kaspersky's investigation found no evidence of file encryption or active malware processes, indicating the attack was contained within Active Directory. Recommendations for organizations include monitoring GPO modifications, implementing multi-factor authentication for VPN access, and safeguarding privileged accounts.

Winsage

September 19, 2026

Microsoft fixes bug behind ‘Defender Antivirus is turned off’ alerts

Microsoft resolved an issue that caused misleading alerts indicating that Defender Antivirus was disabled after recent updates. This fix was confirmed in an update to the Windows release health dashboard and was implemented in the Microsoft Defender Antivirus update (version 4.18.26080.4) rolled out on September 17. The bug, acknowledged by Microsoft in late August, affected users in the Release Preview Channel of the Windows Insider program since at least June and impacted all supported versions of Windows clients and servers. Users received erroneous notifications in the Windows Security app prompting them to activate Microsoft Defender Antivirus, despite it functioning correctly. Misleading alerts could appear upon Windows startup and intermittently thereafter, even when notification settings were disabled.

Winsage

August 30, 2026

5 Windows Security Settings You Should Never Skip Over

Microsoft has over 1.4 billion active devices each month, making it a target for security vulnerabilities. Users can enhance their security using built-in features without third-party software. Key security measures include: - Windows Hello: Enables secure login via PIN or biometric methods. Activation steps: Settings > Accounts > Sign-in options > Select method > Set up. - Windows Firewall: Protects against malicious internet traffic. Activation steps: Settings > Privacy & security > Windows Security > Firewall & network protection > Toggle on Microsoft Defender Firewall for Public, Domain, and Private networks. - Microsoft Defender: Pre-installed antivirus solution. Ensure it is operational by enabling Real-time protection and Controlled folder access. Activation steps: Settings > Privacy & security > Windows Security > Virus & threat protection > Manage settings. - Microsoft Account: Linking a Microsoft account provides benefits like cross-device syncing and advanced security features. Steps to link: Settings > Accounts > Your info > Sign in with a Microsoft account. - Device Encryption: Protects sensitive information using BitLocker. Activation steps: Settings > Privacy & security > Device encryption > Toggle on. - Find My Device: Allows users to locate their device if lost. Activation steps: Settings > Privacy & security > Location > Toggle on Location services > Find my device > Toggle on Find my device.

Winsage

August 14, 2026

August’s Patch Tuesday is a monster: 751 fixes, with an exploited Windows flaw

Users can connect to SMB shares with features like RDMA, leases, and Continuous Availability, allowing efficient data transfer and session management. Hyper-V users can create, checkpoint, and export Generation 2 virtual machines, enable virtual TPM and BitLocker, and connect USB storage and MIDI devices. MSI package management has improved, allowing easy installation, repair, and uninstallation with UAC prompts. TAPI has 11 entries focused on parity fixes, with enhancements in TCP/IP, HTTP.sys, Windows Firewall, Bluetooth, wired 802.1X, and message queuing. Users can verify TAPI line status, HTTP.sys functionality across protocols, and confirm TCP/IP IPsec tunnels. Office updates include client updates for MSI Office 2016 and SharePoint Server updates for 2016, 2019, and Subscription Edition, requiring attention to browser-based editing functionality. On-premises Exchange Server receives a security update addressing seven CVEs, including one critical elevation of privilege vulnerability and six important issues.

Winsage

August 7, 2026

Permanently disable Microsoft’s hidden tracker on all Windows 11 versions with this script

Microsoft's Global Device Identifier (GDID) is an internal marker that uniquely identifies each Windows installation across Microsoft services. It is a persistent device-level identifier that remains constant across supported services, and there is no option to disable or regenerate it manually. Windscribe has developed a free utility called deGDID to permanently remove the GDID from Windows systems and prevent its recreation. This tool operates by blocking Microsoft registration pathways and wiping local GDID-related states without altering system files. While it can remove the GDID from the local system, it cannot erase historical records linked to the device. Windscribe provides instructions for using the tool, which is compatible with Windows 10 version 22H2 and all versions of Windows 11 from 21H2 to 25H2. Users should be aware that disabling GDID generation may impact Microsoft services that rely on device identification, but the tool includes an undo feature to revert changes.

Tech Optimizer

August 3, 2026

Best Free Antivirus Software

Microsoft Defender is the primary recommendation for most Windows users, as it is integrated into Windows and receives regular updates. Other antivirus options include: - Bitdefender Antivirus Free: A streamlined, Windows-only option with automatic protection after installation. - Avast One Free: A cross-platform suite with a custom scan creation feature. - AVG AntiVirus Free: A traditional free antivirus for personal and family use with an initial scan built into the installation. - Avira Free Security: Offers virus scanning and protection for private non-commercial use. - Malwarebytes Free: A manual cleaner for on-demand scanning and cleaning. - ZoneAlarm Free Antivirus: Combines antivirus with configurable firewall controls for Windows. - ClamAV: An open-source scanning toolkit with command-line tools. The selection process focused on the availability of free products, vendor support, and the specific roles of each software, distinguishing between full-time antivirus tools and on-demand scanners. Recommendations include using Microsoft Defender for Windows 10/11, Bitdefender for simplicity, Avast or AVG for fuller apps, Avira for private home use, Malwarebytes for manual cleaning, ZoneAlarm for firewall controls, and ClamAV for technical scanning.

Winsage

July 10, 2026

Microsoft Warns of GigaWiper Backdoor Built to Destroy Windows PCs

Microsoft has unveiled a destructive Windows backdoor named GigaWiper, which allows operators remote control over compromised systems to execute irreversible damage. GigaWiper originated from cyberattacks in October 2025 and is a composite of code from at least three malware families. It maintains its presence through a scheduled task disguised as “OneDrive Update,” executing at startup and every minute. GigaWiper can obliterate partition information, overwrite physical drives, and restart systems. It also mimics ransomware by encrypting files with the .candy extension, using randomly generated keys that are not stored, making recovery impossible. The malware has connections to the Crucio ransomware and resembles FlockWiper, with rewritten code in Go. GigaWiper features 20 command codes for various functions, including executing PowerShell instructions, managing processes, capturing screenshots, and remote access similar to VNC. It can remain on a system for surveillance until its destructive functions are activated. Microsoft Defender includes detection capabilities for GigaWiper, and users are advised to enable tamper protection and monitor for suspicious activities.

Tech Optimizer

June 4, 2026

How We Test Antivirus and Security Software

Most software applications clearly indicate their functionality, but the effectiveness of antivirus utilities is often less tangible. PCMag rigorously evaluates antivirus products through comprehensive tests that validate their claims, including real-world malware samples and various protective measures. Each antivirus tool is assessed based on its on-demand scanner and real-time monitor capabilities. PCMag compiles fresh malware samples annually, analyzing them to ensure they are suitable for testing. The testing process includes evaluating malware-blocking capabilities and web-level protection against known malware-hosting sites. Phishing site detection is also tested using recent URLs, and antispam testing has been simplified due to the effectiveness of email providers. Performance impact tests have been discontinued as modern security suites show improved efficiency. Firewall protection is evaluated through program control, exploit defenses, and overall resilience against malware. Parental control features are tested for effectiveness in content filtering and monitoring. Ransomware protection is assessed by releasing real-world samples in a controlled environment. PCMag monitors independent antivirus lab tests from various organizations, including AV-Test, AV-Comparatives, SE Labs, MRG-Effitas, and AVLab, to inform their reviews. An aggregate testing score is calculated to summarize lab results. Testing methodologies do not include VPN evaluations, which are covered separately.

Winsage

May 19, 2026

Windows Firewall stands between you and greasy delight

A fast-food venue in Sheffield's Centertainment is experiencing a glitch on its order progress screen due to a notification from the Windows Defender Firewall, indicating that some software is attempting to breach the kitchen's digital defenses. The pop-up message cannot be dismissed by customers and highlights the restaurant's reliance on technology. The Windows Defender Firewall has been a part of digital security since Windows XP and has evolved significantly over time. The incident suggests potential misconfigurations within the restaurant's system and raises questions about opportunities for branding enhancement.