Malware News Microsoft Defender Stops QNET Ransomware Attack in 128 Seconds With Automatic Device Isolation

[Parkinsond]

Content source

https://cybersecuritynews.com/microsoft-defender-stops-qnet-ransomware-attack/

The attack began after a user opened a malicious file, likely delivered through email or a browser download.

It launched mshta.exe, a legitimate Windows utility, which contacted attacker-controlled infrastructure to collect a remote payload and prepare persistent activity.

One flagged suspicious command activity connected to RunMRU registry use, while a correlation engine judged the combined behavior to be malicious rather than normal administration.

The final time from first detection to isolation was 128 seconds. The affected device lost internal and external network access, except for security-management traffic, ending its communication with the attacker-controlled service and leaving an auditable timeline.

Microsoft Defender Stops QNET Ransomware Attack in 128 Seconds With Automatic Device Isolation

A malicious file abused Windows mshta.exe to fetch a payload, enabling persistence, credential theft, and network compromise.

cybersecuritynews.com

 

[Parkinsond]

Can any firewall with prompts, such as WFC, abort the attack by denying mshta.exe internet connectivity?

 

[SeriousHoax]

Can any firewall with prompts, such as WFC, abort the attack by denying mshta.exe internet connectivity?

Yes, WFC/SimpleWall/etc. similar Firewall blocks first then show a prompt. They can't halt the connection while showing a prompt like a third-party AV firewall.

So looks like there wouldn't have been any second-stage payload if mshta.exe was blocked in the firewall.

The mshta.exe process contacted an attacker-controlled URL and retrieved a second-stage payload.

128 Seconds to disruption: Microsoft Defender stops ransomware at QNET | Microsoft Security Blog

Microsoft Defender automatically isolated a compromised QNET endpoint in 129 seconds, stopping a multi-stage attack before the payload could persist or spread.

www.microsoft.com