Target Industry
Indiscriminate, opportunistic targeting.
Overview
An emergency update was released by Microsoft on 19th August 2025 to fix a critical issue affecting Windows recovery and reset operations. The problem was introduced by the August 2025 security updates and affects both Windows 10 and older versions of Windows 11.
Impact
Broken recovery/reset tools mean compromised systems can’t be easily restored, increasing exposure to threats. IT teams may face increased helpdesk tickets due to failed resets or update errors. Delayed patching cycles can leave systems vulnerable or non-compliant with internal policies or external regulations. Devices stuck in failed update loops can lead to frustration and lost work hours.
Problematic updates:
- KB5063875 – Windows 11 23H2 & 22H2
- KB5063709 – Windows 10 22H2, Enterprise LTSC 2021, IoT Enterprise LTSC 2021
- KB5063877 – Windows 10 Enterprise LTSC 2019, IoT Enterprise LTSC 2019.
Containment, Mitigations & Remediations
To mitigate the impact of a known issue affecting remote device resets via the RemoteWipe Configuration Service Provider (CSP), Microsoft released a series of emergency out-of-band (OOB) cumulative updates on 19th August 2025.
These updates supersede all previous updates for the affected versions and do not require prior patches to be installed. Microsoft advises organisations that have not yet deployed the August 2025 security updates to apply these OOB updates instead, unless their devices are confirmed to be unaffected.
Additionally, on Friday 15th August 2025, Microsoft issued a Known Issue Rollback (KIR) to resolve a separate bug that caused update failures when using the Windows Update Standalone Installer (WUSA) from a network share.
Threat Landscape
More than 3.7 million companies worldwide rely on Microsoft 365 products. Microsoft has detected an increase in cyber-attack campaigns that exploit legitimate file hosting services
Threat Group
The specific threat group behind this has not been publicly identified at the time of writing.
Further Information
Intelligence Terminology Yardstick
