QakBot attacks with Windows zero-day (CVE-2024-30051)

Kaspersky discovered a previously undocumented Windows DWM elevation-of-privilege zero-day (CVE-2024-30051) after finding a suspicious VirusTotal document; they confirmed the bug, reported it to Microsoft, and a patch was released on May 14, 2024. Kaspersky observed the exploit in the wild in mid-April 2024 being used with QakBot and other malware, believes multiple threat actors had access, and provides detection names for the exploit and associated malware.