CVSS 8.5CRITICAL
The severity is rated as CRITICAL due to the potential for widespread operational disruption and system destruction. Real-world exploitability in both homelab and production environments is high, particularly with the manual nature of these attacks relying on common administrative tools. There are no mature patches available, making the window of exposure significant.

Geopolitical tensions are increasingly leading to cyberattacks motivated by disruption rather than financial gain, with Iranian wiper campaigns serving as a prime example of this trend. These attacks target critical infrastructure and supply chains, aiming to cause operational chaos through the destruction of systems. Recent incidents, such as the Handala attack on Stryker in March 2026, demonstrate the potential for these attacks to impact global operations severely. The playbook suggests focusing on containment and internal control by implementing measures that limit lateral movement within networks.

Affected Systems
  • RDP
  • PowerShell remoting
  • WMI
  • SMB
  • SSH
Affected Versions: All versions in use by organizations without specific security controls
Remediation
  • Implement identity-aware access controls and enforce MFA for accessing administrative services using the command: `Enable-MultiFactorAuthentication -ServiceType Administrative`.
  • Configure default-deny policies for administrative ports with the command: `Set-NetFirewallRule -Name 'AdminPorts' -RemotePort 3389,5986 -Action Block`.
  • Segment privileged access based on role and environment by updating Active Directory Group Policy settings to restrict admin rights: `gpedit.msc -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment`.
  • Monitor east-west connectivity using network monitoring tools such as Wireshark or SolarWinds NPM.
Stack Impact

The impact on common homelab stacks is significant, affecting software like RDP (Windows 10 and above), PowerShell remoting (Windows Server 2016 and above), WMI (Windows 7 and above), SMB (all versions), and SSH (OpenSSH for Windows). Configuration files such as `sshd_config` for SSH and Group Policy settings in Active Directory are directly affected.

Source →