clearinfosec.com ↗

Author: Clear Infosec

AstraLocker 2.0 – Smash and Grab attacks

In 2021, Security researchers from ReversingLabs tracked a relatively unknown malware which was later named AstraLocker. The latest version of AstraLocker, meanwhile, was first observed in March 2022. Rather than the “Low and Slow” methodology that is common among sophisticated ransomware groups, this virus is so unique that it acts immediately after it a user opens the malicious file.

Version 2.0 was directly distributed from Microsoft office files used as bait in phishing attacks. The underlying code for AstraLocker 2.0 is likely to be obtained from a leak of Babuk Ransomware in 2021. Shared code and marketing markings are the ties between the two campaigns, and a Monero wallet address offered for ransom payment is connected to the Chaos Ransomware gang.

The affected files will have a “.AstraLocker” extension with its file name. for example, a word document with the title “sample.docx” will become “sample.docx.AstraLocker”. In every folder containing the encoded files, a Recover_Your_Files.html text file will be found. It is a ransom money memo. You can learn there how to get in touch with the racketeers as well as other information. Instructions on how to buy the decryption tool from the hackers are possibly included in the ransom note.

The below image shows how encrypted “.AstraLocker” files look.

Source: How to fix guide

For the AstraLocker virus to get into your system, there are 3 detected popular ways. They are spam emails, Trojan Injection, and Peer networks.

Emails from unknown senders may sometime escape your spam box and no matter how legitimate it seems, opening any documents from unverified senders are never recommended. Other than emails, bad actors might use Trojan horses to infiltrate your machine by disguising it as something legal. As for the peer networks like torrent trackers, you never know what you are downloading unless you finish the download. So, when using such services, always use trustworthy resources. Additionally, as soon as the downloading is complete, it makes sense to run an antivirus scan on the folder holding the downloaded goods.

Steps to Remove AstraLocker virus

It is always better to stay proactive than to be reactive.

One of the best choices is to have OS restore points or keep the copies of important/sensitive files in the cloud or external storage. Even that might not work as expected as you might still lose the last file you were working on at the time of the attack. It is always recommended to keep an antivirus program in your system and to run the test regularly and mandatorily whenever you perform an OS rollback.

Also, thoroughly go through readme-files in the encrypted files because there are cases reported with attackers accidentally sharing the decrypting key in them. But this is only a rare chance that you should never expect to happen.

Important to note: Along with encrypting your files, the AstraLocker virus will probably install the Azorult Spyware on your computer to steal your login information for other accounts. That application can obtain your login information via the auto-fill information in your browser.

Myth buster: AstraLocker 2.0 ransomware has no endless power, and neither does any similar malware.

Announcement: A free decryptor released for AstraLocker and Yashma ransomware

August 16, 2022
Roaming Mantis targets Android and iOS
Roaming Mantis malware that targets Android and iOS devices is detected in France after hitting Germany, Taiwan, South Korea, Japan, the US, and the UK. This malware did compromise tens of thousands of devices and is believed to be a financially motivated threat actor, which was first reported in February 2022 targeting European users.

MoqHao (aka Wroba, XLoader for Android) is an Android Remote Access Trojan (RAT) with information-stealing and backdoor capabilities that spread via SMS. It is attributed to Roaming Mantis, which is thought to be a Chinese threat organization with financial motivations.

How the Malware works

The threat actor uses SMS to lure users into making them download the malware onto their devices. This smishing campaign was first observed by Sekoia.io analysis through malicious SMS received.

The SMS says that “Your package has been sent. Please check it and receive” and contains a link. If any user clicks on that link, the users are redirected to a phishing page designed according to the device they have and the location they are at. Now, the Roaming Mantis is detected in France and the messages received are in French.

iPhone users receive an SMS with a link to a phishing site that can steal Apple credentials. But for Android users, the SMS pushes them to install a mobile app – an Android Package Kit (APK). But for any user outside France, the URL redirects to a 404 error.

The infrastructure of the threat

Analysts of this threat report that the infrastructure of Roaming Mantis has not changed much when compared to the last analysis done in April.

As the threat is targeting both iOS and Android devices, there are two different infection chains detected.

Android Payload

The servers have the ports like TCP/443, TCP/5985, TCP/10081, and TCP/47001 open. These servers are set to target only one country and traffic from any other country is set to display a 404 error.

Apple Phishing

The servers have TCP/80, TCP/5432, TCP/5985, and TCP/47001 open. The landing page is designed in a way that replicates the Apple ID login page. Same as the Android infrastructure, this is also geofencing and any traffic from other countries results in a 404 error.

Domains

The domains used inside the Smishing SMS are found to be registered in either “GoDaddy” or dynamic DNS servers like “duckdns.org”. The intrusion set uses more than a hundred subdomains, and each IP address is resolved by dozens of FQDNs.

Do not fall victim to Mantis

To prevent Roaming Mantis and other Android malware from infecting your device, you should never allow the installation of apps from untrusted sources, and you should never download APKs from strange sites.

Furthermore, SMS texts that contain URLs should always be treated with caution and suspicion, even if they come from someone you know. If you have even a slight doubt about the sender of the SMS, instead of opening the URL in it, try visiting the vendor that it disguises as directly.

Finally, given that analysts actively monitor these activities, an Android internet security solution from a reliable vendor could assist flag these URLs upon accessing them.
August 11, 2022
Recent Ransomware attacks 2022

Ransomware attacks have become very high in recent days. The ongoing attacks cause losses to lots of organizations. Knowledge of Ransomware and its anatomy is very important to mitigate these attacks. Some simple Protection and Response plans available can be useful in understanding the basics of the mitigation process. Let’s see some of the attacks by Ransomware groups on famous industries.

In January 2022, the ransomware attack on Bernalillo country in New Mexico can be considered the starting point of this year’s cyber-attack on a large scale. This attack causes many educational institutes and government institutes. The officials, however, said that they didn’t pay any ransom.

The famous sports manufacturer Puma had a data breach on their employee information. Almost 6000 employees’ personal information has been stolen. But the officials announced the customer’s data were not damaged.

Similarly, in Portuguese Media, Impresa was attacked by the Lapsus$ gang. This happened during the New year holidays blocking the organization’s websites and online services.

A multinational defense contractor, Hensoldt, which provides sensor solutions for the defense and security software for many US dense organizations, was under a Ransomware attack. Authorities didn’t reveal the details of the attack, but the ransomware group Lorenz which claimed responsibility for the attack, said they received the ransom. Whether the ransom was paid or not can be a debate.

The LockBit ransomware gang attacked Bridgestone organization, one of the largest manufacturers of tires, in Feb 2022. The organization tried its best to mitigate the attack, but still, the company was forced to halt its productions for nearly a week. The LockBit gang later threatened the company to pay the ransom before 15^th march, or they would leak the stolen information. There was no official information on whether the organization paid ransom or not. Still, it is reported that the company was able to perform a comprehensive security check and reconnect to its network.

Near the end of February, one of the largest microchip makers in the USA, Nvidia, was attacked by the Lapsus$ gang, the same one that attacked Impresa. It was confirmed that the group had stolen the data of employees and proprietary company data. Because of this breach, the company went offline for two days. It was rumored that Nvidia tried to hack the attackers to retrieve the data. But Nvidia authorities announced that they are in the process of analyzing the data loss and have not commented on the hacking part.

In March 2022, Okta, the identity and access management company, confirmed that there was an unsuccessful attempt on their data. Lapsus$ group announced in their Telegram group that they had breached the company’s security and accessed their data. It was later confirmed that Sitel, an Okta sub-processor that provides Okta with contract workers for our Customer Support organization, was breached, and nearly 300 customers were compromised.

The same organization publicly announced that they had claimed an account in Microsoft and gained limited access. Microsoft announced they received an alert and started the mitigating process, and when the attacker announced in public, the company intervened and stopped the attacker. The company also assured “no customer code or data was involved in the observed activities.”

Known ransomware attacks in April 2022 by country

From the pie chart provided by Malwarebytes, it is clear that ransomware attacks are very high worldwide. These charts were only for April, which shows the alarming number of attacks.

The new gang, Black Besta, came out of nowhere and conducted nearly eleven successful breaches of organizations. Experts in the field believed it might be some old gang re-established themselves in the new name. Some of the organizations attacked are American Dental Association and Deutsche Windtechnik.

Austin Peay State University also confirmed it had been a victim of a Ransomware attack. The university asked the professors and students to immediately disconnect their systems from the university network. These actions were taken by posting the alert in their official tweet.

It can be very clear that many attacks were happening worldwide in all industries. Even the top giants also become victims of these attacks. It shows that good knowledge and a well-equipped cybersecurity team are highly important. Moreover, due RaaS model, carrying out ransomware attacks becomes simplified. To know more about the latest trends in cybersecurity services and ransomware, you can check the clearinfosec site.

August 1, 2022
ToddyCat APT unveiled

Multiple threats detected from December 2020 against high-profile entities in Europe and Asia are finally traced to be responsible by a new Advanced Persistent Threat (APT) actor. Not much information about this is not yet gathered but its noticeable signs are the use of 2 previously unknown tools named “Samurai Backdoor” and “Ninja Trojan”.

Since its start in December 2020, this threat managed to compromise selected Exchange Servers in Taiwan and Vietnam with the use of an unknown exploit leading to the creation of the well-known China Chopper Web Shell, which in turn used to initiate a multi-stage infection chain. Numerous components including custom loaders were found to be used in the final execution stage of passive backdoor samurai. Only 3 organizations were targeted at first by the group behind ToddyCat APT. But the count raised with the group exploiting the ProxyLogon vulnerability to compromise multiple servers across Europe and Asia.

It is suspected that the group started exploiting Exchange Servers in December 2020, but the information to confirm this is insufficient. The Samurai passive backdoor, a sophisticated backdoor that typically operates on ports 80 and 443, was used to hack Microsoft Exchange Servers, which were the only targets of the first wave of attacks.

During the period of the second wave, researchers found a sudden surge in the attacks. It is at this time the backdoor exploited the ProxyLogon vulnerability.

The attack surface in the third wave is noted the third wave increases the attack surface to include desktop systems, whereas the first two waves solely affected Microsoft Exchange Servers.

Credits: Kaspersky

Security researchers say that there is only a little information is available about this threat actor.

As mentioned earlier in this blog, the APT leverages 2 passive backdoors in the Exchange server environment with malware called Samurai and Ninja and takes complete control of the victim’s hardware and network. The Samurai malware uses multiple modules that allow the attackers to take control of the remote systems and freely move inside the targeted network. In some cases, Samurai backdoor lays a path to launch another malicious program called Ninja.

The affected governmental and military groups demonstrate that this group is focused on highly prominent targets and is likely employed to accomplish important objectives, most likely connected to geopolitical interests.

July 22, 2022
Ransomware As A Service
Ransomware as a service is a business model where the customers or the malicious party use the ransomware developed by the experienced hacker. They may pay a certain amount, or a certain percentage of the total ransom received using this tool or code. This may be an example of software as a service.

And the best part of RaaS is the person who uses this service does not need to know anything about coding. In the past, any attacker needs to have a good amount of knowledge in coding to initiate the attacks. But with the model of Raas, the user is not required to know even the basics of coding and still can execute the attack.

This increasing trend of Raas gives a huge disadvantage to cybersecurity experts. The number of ransom attacks has been on the increasing graph ever since the Raas model was started. Companies or organizations of all sizes are trying their best to increase their cybersecurity to reduce the victimization of Raas.

Ransomware attacks are found to be always on the rise. According to the report jointly given by The Cybersecurity and Infrastructure Security Agency (CISA), the FBI, and the NSA, ransomware attacks in 2022 will only be on the rising side.

The most dangerous thing about Raas is it’s very easy to find. It becomes like ordinary goods sold on a market. Some Raas kits even have 24/7 support; other offers, there are forums on this kind of service to provide user services. They follow the same kind of treatment as SaaS. This kind of Raas service is not much costly too. If they buy a kit for 40 to 50$, they can earn up to thousands of dollars if the attack is successful. The person who uses RaaS needs a few attacks to succeed in becoming a rich person.

The way RaaS work

First, the skilled ransomware developer will create a new kind of ransomware that is unlikely to be discovered by the organization’s firewall or cybersecurity team. This itself will give a high chance of a successful attack.

The developed code is then advertised in the designated forum or in other ways. The code will be developed to be modified easily to meet the multi end-user infrastructures. The developers mostly use cloud concepts, so it will be easy for users to use. We can call the customer’s affiliates.

Next, the affiliates will spread the malware. It may be a targeted attack or send the malware on the internet and wait for the user to get phished. It should be noted that phishing attack may look simple but causes more damage.

If the attack were successful, the money would be distributed among the affiliates and developers, as discussed earlier. There are many methods for this distribution, which will be explained briefly on the following page. It should be noted that most of the ransom was asked in cryptocurrency nowadays. This is to make use of the advantage of blockchain technology.

The model of RaaS

Almost all the RaaS methods will come under this kind of model. This model is based on profit distribution profits between the developer and affiliates.

Monthly Subscription

In this method, the users pay a monthly fee, like subscribing to a newspaper and earning some percentage of the successful ransom. The developer may use the money from the subscription to develop a code or consider it a pure profit if there are many subscribers.

Affiliate

In this model, a certain number of profits will be given to the RaaS developer. Instead, a developer will provide efficient service and support till the attack is successful.

One-time access

The customer will pay the amount upfront and buy the code in this model. What he does with that and the profits earned solely belong to the customer.

Profit sharing

This model is similar to the affiliate model. The profits are divided between the developer and customer based on their predetermined conditions.

By understanding how RaaS works and familiarizing yourself with their models, the cybersecurity team to develop their defense. As a cybersecurity expert, you need to be aware of attacks’ different methods and principles to develop a successful defense. It is best to understand more about ransomware, its anatomy, and prevention methods, even if you are not in cybersecurity. Knowing this knowledge may help you avoid becoming a victim of ransomware attacks.
July 15, 2022
Ransomware Blockchain

This blog will see whether it is possible to use the blockchain concept to track ransomware attackers or prevent such attacks. I have explained Ransomware in my previous blogs, and you can look into it for more details.

Everyone will be aware of cryptocurrency at this age. The arrival of cryptocurrency as a boon or curse is still a debate. Cryptocurrency uses blockchain technology for the transaction. With rising cryptocurrency trends and the advantage of blockchain technology, cybercriminals started to ask for cryptocurrencies as a ransom.

Source: Chainalysis

According to the data collected by chainalysis, more than 600 million USD are transacted as ransomware. They also mentioned that with continuous updates and the range of 2021 may increase further and might be higher than the year 2022.

Blockchain is a decentralized and digital log of encrypted transactions in the form of blocks. Each transaction is verified by the majority of the participants of the system. The emergence of blockchain also caused a rapid increase in a ransomware attacks. It is mainly because the attackers can demand the ransom in cryptocurrency, and because of its technology, the anonymity of the attackers can be maintained.

It becomes a game between security experts and attackers to use blockchain for good or harm.

Blockchain logs are decentralized, so there won’t be a single copy of the confidential data. Also, according to blockchain technology, once the data is entered, it’s impossible to change it. Because of this, both the sender and receiver of the data can be sure that no data has been altered.

Since the data is decentralized, the critical information ends up in many places. There may be different organizations may store data in the same decentralized storage. This also makes the attacker’s work difficult. If an attacker needs to take the data, they need to compromise multiple protocols in different places.

Blockchain also uses the sequential hashing (SeqHash) technique; this helps secure the integrity of the data or blocks every 10 minutes. Each company will use its encryption for data too.

But obviously, if there are any errors in decentralized architecture, the attackers can use them as entry points. If there is one thing that can be sure about security is there is not 100% safe. Cybercriminals will find a way to extract a loophole if security experts find a way to protect. It’s an endless cycle, and whoever is up to date and on top of their game will achieve victory for that moment.

July 1, 2022
Follina – ZeroDay hole in MS Office

Microsoft has confirmed a Remote Code Execution (RCE) vulnerability in Microsoft Support Diagnostic Tool (MSDT) which is expected to be exploited since April, at least. It was on May 27^th, 2022, reports came about malicious word documents that leverages remote templates in order to execute PowerShell via the ms-msdt Office URL scheme. This vulnerability is assigned with CVE-2022-30190.

An attacker who successfully exploits this flaw can execute arbitrary code by calling application’s privileges. In the context allowed by the user’s permissions, the attacker can then install applications, read, alter, or remove data, and create new accounts.

It all started with a security researcher finding a document on VirusTotal that was used to execute PowerShell code. The security researchers have been analysing the malicious file and discovered that it was actually exploiting a zero-day vulnerability in MSDT. With this file, the researchers found that it will take only opening the file to trigger the exploit.

Analysis:

Follina is an RCE vulnerability found in MSDT that impacts several versions of Microsoft Office, including the patched versions of Office 2019 and 2021. Though an attacker leveraging flaw is likely to be Remote, Microsoft list the attack vector as “local” because of the way it is exploited.

An attacker would create a malicious document, usually in Microsoft Word, and email it to their victim. An attacker can leverage this vulnerability to run commands with the permissions of the application that opened the infected document. Microsoft says that the attacker will be able to install programs, view, change, or delete data, or create new accounts.” The PowerShell was found to be used in the attacks observed in April. A broad range of attacks are expected with this vulnerability in the near future.

Proof of Concept:

A detailed technical breakdown of this vulnerability is provided by Huntress Labs and you can also find other PoC in GitHub.

Remediations:

An effective patch is not yet released at the time of writing, you can find mitigation steps to limit attack surface. Microsoft has released mitigation guidance for this vulnerability and this vulnerability was revealed by a member of the Shadow Chaser Group, according to Microsoft’s alert.

The mitigation guidance says that in Microsoft Defender, activate “Block all office apps from creating child processes” in Block Mode in order to prevent this vulnerability from being exploited. It is still not unclear what the impact would be for this mitigating effort.

June 3, 2022
WINDOWS LSA Spoofing Vulnerability
Microsoft released a patch for Windows Local Security Authority (LSA) spoofing recently. This was one among the 74 security flaws reported to be fixed with the new patch, including 7 critical, 66 deemed important and 1 low severity.

Windows LSA spoofing vulnerability (CVE-2022-26925) is being wildly exploited. As per Microsoft an unauthorised bad actor will be able to “coerce the domain controller to authenticate to the attacker using NTLM.” A bad-actor, via man-in-the-middle attack can easily exploit this vulnerability. They inject themselves into the logical network path between the target and the resource requested. The bug individually has a 8.3 CVSS severity score but when combined with NTLM relay attacks, the combined severity score is would be 9.8, according to Microsoft.

Cybersecurity and Infrastructure Security Agency (CISA) have added this vulnerability in their “Must-Patch” list because federal agencies are advised to patch the vulnerabilities within a specified timeframe. Microsoft is giving further mitigation instructions for this vulnerability, as well as a default configuration for Windows servers with specified roles enabled, which permits exploitation of the vulnerability.

“The story behind CVE-2022-26925 is no advanced reverse engineering, but a lucky accident. During my pentests in January and March, I saw that PetitPotam worked against the [domain controllers],” said Raphael John from Bertelsmann Printing Group, who has been credited by Microsoft for reporting CVE-2022-26925 on Twitter.

Microsoft has addressed this vulnerability with the May patches release and warned at the time that the vulnerability has been publicly disclosed and exploited in attacks. The May 10 upgrade should not cause issues on client devices or non-domain controller servers, according to CISA, and users should continue to install it on these devices.

Base Score Metrics explained

Attack Vector

It describes the context by which the vulnerability exploitation is possible. In this case, it is the Network. The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet.

Attack Complexity

It describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability. In this case, it is High. requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected.

Privileges required

It describes the level of privileges the attacker must have in order to exploit the vulnerability. In this case, it is None. The attacker is unauthorized and requires no access to settings or files to perform an attack.

User Interaction

It describes the requirement for a user other than the attacker to perform a successful attack. It is None in this case. The vulnerable system can be exploited without any user interaction.

Scope

It shows the if components other than the vulnerable component are affected with the attack when the vulnerability is exploited. Base score increases if so. It is Unchanged in this case as this vulnerability, when exploited, can affect only the resources managed by same security authority.

Confidentiality

It measures the impact to the confidentiality of information resources managed by a software component due to a successful exploitation. In this case, it is High as there is a total loss of confidentiality.

Integrity

It measures the impact to the integrity of a successful exploitation. It is High in this case as there is a total loss of integrity.

Availability

It measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.

This vulnerability is actively under exploitation, and we recommend updating the new Windows May patch. With Clear Infosec Threat Intelligence Bulletin, stay update of the new threats and stay fortified.
June 1, 2022
Do you know about Denonia?
Malware that targets AWS Lambda Environments

A first-of-its-kind malware that is specifically designed to execute in an AWS Lambda environment has been discovered by Cado labs. Even serverless environments are no longer safe. While the malware’s distribution is limited, the discovery of such malware is evidence of bad actors’ advanced technical skills and their interest in cryptocurrency.

What is AWS Lambda

AWS Lambda is serverless, event-driven compute service that runs code for any application or service without managing a server. It runs the code in response to events and can be triggered from over 200 AWS services and SaaS applications.

A serverless environment doesn’t mean there isn’t any server lying behind, but the user doesn’t have to manually manage the virtual machine or infrastructure behind it. AWS Lambda automatically manages the underlying computing resources, unlike AWS EC2 (Elastic Compute Cloud).

Why a malware inside a serverless environment can be a big deal?

It is the cloud provider who manages and secures the underlying server, operating system, etc. reducing the attack surface. Under AWS shared responsibility model, AWS manages and secures the Lambda environment while the users secure the functions. Another feature to be mentioned is its ephemerality. AWS Lambda is short-lived, which means its runtime duration is very short. Security features of AWS lambda allow it to act only when the right resources or services with the right permissions try to invoke it.

But we need to note that nothing could stop DENONIA. Denonia can be a great example that attackers are gaining advanced cloud-specific knowledge to exploit even the complex cloud infrastructure. It is still a mystery exactly how the bad actors were able to deploy Denonia in the AWS Lambda environment. This single malware shows that there might be more attacks to come.

Denonia Malware

Denonia malware is 64-bit executable targeting x86-64-bit architecture that is written in Go language. It is named after the domain it communicates with (gw.denonia.xyz).

Denonia malware executes a customized version of XMRig in the lambda environment. XMRig is a software that is intended to mine Monero cryptocurrency. The malware uses several 3^rd party libraries including the one that enables execution inside the AWS lambda environment. The security researchers were able to execute the malware on AWS Linux boxes used by the Lambda environment.

How Denonia works

Denonia communicates with Command and Control (C&C) servers using a GO library that supports DNS over HTTPS (DoH). The DNS queries are encrypted, and the requests go out as regular HTTPS traffic to DoH resolvers like Cloudflare, Google, etc.

This technique provides some benefits which we must note. AWS cannot see the DNS lookups for the malicious Denonia domain, which helps to avoid detection from cloud workload protection tools. Since DNS requests appear as HTTPS traffic, it bypasses VPC level DNS controls.

When DNS resolvers send an IP address back to malware, it simply writes it to XMRig, and the malware then starts XMRig from memory and communicates with the hacker mining pool to get the mining job started.

The future implications

Even though the malware seems to be causing harm to anybody now, the techniques used behind might open doors to more harmful attacks in the coming days. This single malware proved that even the serverless environments are not fundamentally secure as we thought they were.

The need to build new security tools to deal with malware detection and prevention within the serverless environment is on the rise.

Protect yourself from Denonia

How Denonia gets deployed in the Lambda environment is still unknown. But it is important to take all possible security measures to bring more security to avoid it.

Keep your AWS credentials secured and do not share them with anyone

User accounts should be carefully set up with the least privileges

Enable MFA for every account

SSL/TLS protocol should be used to communicate with AWS resources

Enable API and user log in with AWS CloudTrail

Monitor activity logs regularly

Found the article interesting? Follow us on LinkedIn, Facebook & Twitter for more updates on the new vulnerabilities and what is happening in the InfoSec community.
May 5, 2022
Microsoft Autopatch

Everyone might have already known that Microsoft announced a feature Windows Autopatch, which will be released in July 2022. This blog is about this new feature that Microsoft is planning to release.
Windows Autopatch is a service mainly designed to update the windows and office automatically. This feature will be available for free for those users who have a subscription to
• Windows E3 or above
• Microsoft Intune
• Windows 10/11
• Azure AD premium.
And it does not apply to Windows Server OS and Windows 365 for Business.
“This service will automatically keep Windows and Office software on enrolled endpoints up-to-date at no additional cost. The second Tuesday of every month will be ‘just another Tuesday’,” promised Lior Bela, a Sr. Product Marketing Manager at Microsoft.
It was mentioned that the patch was mainly released to focus on updating the patch timely to reduce the security threats that may arise because of lag in an update. This update also focused on tackling the complexity involved in software updating in an entire IT organization.
As we know, cybercrime is getting more and more advanced. Their knack for catching the loophole is also high reading all the attacks. So, we can guess they are hoping this update may reduce the attackers to catch this simple entry into the network or system, which may arise due to lag in time to update.

Source: Windows

According to the description given by Microsoft, the windows autopatch feature automatically creates four testing rings. Each of the testing rings represents all the diversity in an enterprise.
The updates are initially tested on a small set of devices. If the update and installation create no further problems, the installation will be extended to larger sets of devices.
The “test ring” will contain a minimum number of devices in the organization.
“First ring” is around 1% of all the devices and software needed to keep up to date as soon as possible.
“Fast ring” contains around 9% of the devices, and “broad ring” is around 90% of the rest of the devices.
The population dividend if these rings are managed automatically. But the organization’s IT admins are given privileges to move specific devices from one ring to another ring

Source: Windows

And administrators can also stop, pause or roll back the update if they find any problems during the update or need an older version for their unique requirement.
For more details about the requirements, eligibility, and other information about this feature, you can search in Windows Autopatch FAQ. Lior Bela publishes them.

April 27, 2022