A new exploit tool dubbed MiniPlasma has been publicly released, targeting a critical Windows vulnerability from 2020 that remains unpatched. The exploit leverages the original proof-of-concept code, putting millions of systems at risk.
Security researcher who goes by the handle "DrillHawk" dropped the exploit on a popular code repository late Tuesday. "This bug has been sitting in the dark for four years with no fix in sight. We decided to arm defenders with a practical weapon to test their networks," the researcher said in a statement.
Background
The vulnerability in question is a privilege escalation flaw affecting multiple Windows versions, including Windows 10, 11, and Server 2019. First disclosed in August 2020 and assigned CVE-2020-XXXX (placeholder), it allows an attacker to gain SYSTEM-level access after initial compromise.
Despite repeated warnings from security firms, Microsoft has not issued a patch, leaving the flaw open to exploitation. The MiniPlasma tool uses the original proof-of-concept code, making it trivial for attackers to weaponize.
What This Means
Organizations that have not applied mitigations are now exposed to a reliable exploit chain. The tool works on fully patched systems because the underlying bug was never fixed. Attackers can combine it with other remote code execution exploits to take complete control of a target machine.
Immediate steps recommended:
- Disable vulnerable services (e.g., Secondary Logon) if possible.
- Deploy endpoint detection and response (EDR) tools to monitor for MiniPlasma behavior.
- Restrict local administrator privileges to minimize lateral movement.
"This is a wake-up call for IT teams to assume breach and harden every layer of the stack," warned cybersecurity consultant Jane Li. "A four-year-old unpatched bug is now a live grenade."
The researcher who released MiniPlasma emphasized it is intended for legitimate security testing. However, the code is publicly available, and proof-of-concept exploits are often quickly adopted by threat actors.
Bottom line: Treat every system as potentially compromised. Apply workarounds and monitor logs for signs of privilege escalation. The clock is ticking.