Ransomware Gangs Exploit Windows Task Host Vulnerability, CISA Warns

CISA has verified that ransomware syndicates are actively exploiting the Windows Task Host vulnerability that was first marked as under active attack in April. The agency urges organisations to deploy the latest patches as threat actors accelerate their campaigns.

Windows Task Host vulnerability fuels ransomware surge

Security researchers observe a sharp ↓ 20% drop in remediation windows, meaning attackers have a narrower margin to bypass defenses.

“The exploitation of this flaw signals a shift toward more aggressive ransomware tactics,” a CISA spokesperson told Reuters.

Patch rollout and mitigation steps

Microsoft has released ↑ 5 cumulative updates addressing the flaw across supported Windows versions. Administrators should verify deployment via Windows Update for Business or WSUS, and monitor for anomalous scheduled tasks.

For deeper analysis, see Bloomberg‘s coverage of ransomware trends linked to this exploit.