The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Microsoft Windows zero-day vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. The flaw is being actively exploited by threat actors to conduct Nokoyawa ransomware attacks. The Nokoyawa ransomware group is a financially motivated threat actor first seen in February 2022, and the ransomware is a strain capable of targeting 64-bit Windows systems in double extortion attacks. The flaw, tracked as CVE-2023-28252, is an escalation of privileges (EOP) vulnerability in the Windows Common Log File System (CLFS) that allows attackers to gain SYSTEM privileges on a targeted vulnerable system. The attacks are low complexity, requiring no user interaction, and if successfully exploited, allow the threat actors to conduct a full takeover of targeted Windows systems. The vulnerability affects all supported Windows server and client versions, and its presence on the KEV means that all Federal Civilian Executive Branch (FCEB) agencies must secure their systems against it by May 2, 2023, or face regulatory fines. Microsoft patched this zero-day as part of this month’s Patch Tuesday release. Researchers from Kaspersky’s Global Research and Analysis Team (GReAT) uncovered the vulnerability in February 2023 as a result of investigations into multiple attempts to execute similar EOP exploits on Microsoft Windows systems. The researchers identified that the Nokoyawa ransomware group has utilized at least five (5) other CLFS exploits to target various industries since June 2022. CTIX analysts urge all Windows users to ensure they have installed the most recent patch to prevent future exploitation.