Windows licensing Archives

Winsage

February 13, 2025

Russian Hackers Leverages Weaponized Microsoft Key Management Service (KMS) To Hack Windows Systems

The Sandworm APT group, also known as APT44 or UAC-0145, has been exploiting weaponized Microsoft Key Management Service (KMS) activators to breach Windows systems in Ukraine since late 2023. This campaign uses pirated KMS tools and counterfeit Windows updates to spread malware, targeting state bodies and critical infrastructure. The attackers deploy Trojanized KMS activators, such as “KMSAuto++x64_v1.8.4.zip,” often shared on torrent sites and forums for Ukrainian speakers. The attack begins with the BACKORDER loader, which disables Windows Defender and delivers the DarkCrystal RAT (DcRAT) to exfiltrate sensitive data. A new backdoor named Kalambur is also identified, distributed via a typosquatted domain that pretends to be a Windows Update. Security teams are advised to use Sigma rules and detection tools aligned with the MITRE ATT&CK framework to counter these threats.

Winsage

February 13, 2025

Russian Hackers Leverages Weaponized Microsoft KMS to Hack Windows Systems

The Russian state-sponsored hacking group Sandworm, affiliated with the GRU, has been using pirated Microsoft Key Management Service (KMS) activation tools to infiltrate Ukrainian Windows systems since late 2023. They distribute a harmful ZIP file named “KMSAuto++x64_v1.8.4.zip” on torrent platforms, which, when executed, deploys the BACKORDER loader and disables Windows Defender. The BACKORDER loader then downloads the Dark Crystal Remote Access Trojan (DcRAT) from attacker-controlled domains, allowing data theft, including keystrokes and browser credentials. The campaign exploits Ukraine's high prevalence of unlicensed software, estimated at 70% in the public sector, increasing vulnerability to cyberattacks. Researchers have linked this activity to Sandworm through shared infrastructure and tactics, highlighting its role in Russia's hybrid warfare strategy against Ukraine. Cybersecurity experts recommend avoiding pirated software and implementing robust security measures to mitigate these threats.

Winsage

July 1, 2024

Has Microsoft’s AI Chief Just Made Windows Free?

Microsoft's licensing terms for Windows 11 prohibit users from publishing, copying, renting, leasing, or lending the software. The terms also state that just because a work is available online does not mean it is in the public domain or free to use. Microsoft is protective of its intellectual property and does not allow users to freely use its content.