BlueKeep Attack Detected by AhnLab EDR

This report details active exploitation of the BlueKeep (CVE-2019-0708) RDP vulnerability observed by AhnLab EDR: attackers deliver RCE via the MS_T120 channel and then abuse Windows accessibility features (renaming cmd.exe to Narrator.exe) to run cmd.exe as SYSTEM for privilege escalation. The post links the observed activity to previously described BlueKeep tooling and highlights EDR-detected malicious commands and behavior, emphasizing endpoint monitoring and response.