Red Hot Cyber

La ciberseguridad se comparte. Reconozca el riesgo, combátalo, comparta sus experiencias y anime a otros a hacerlo mejor que usted..
Search

“Cleaning Up” Windows Update! Microsoft Declares War on Drivers Exploited in Ransomware Attacks

Redazione RHC : 24 June 2025 08:06

Microsoft announced that it will periodically remove outdated drivers from the Windows Update Catalog to reduce risk and improve compatibility. “The goal of this initiative is to provide the best set of drivers on Windows Update for the various hardware solutions in the Windows ecosystem and help keep Microsoft Windows secure,” the company said in a statement.

Microsoft also added that “This initiative will periodically clean up drivers on Windows Update, which will result in some drivers not being deployed on systems in our ecosystem.” As the company has clarified, the first phase of the “cleanup” procedure will affect drivers for which Windows Update already has newer alternatives.

With “cleanup” Microsoft intends to remove expired drivers from Windows Update, so that they are no longer offered on any Windows system. This will be achieved by removing the corresponding assignments of the old drivers in the Hardware Development Center. It should also be noted that in the future Microsoft will expand the list of categories that can be excluded from Windows Update for security reasons. Please note that partners will still be able to republish drivers removed by Microsoft if they provide a business justification for doing so.

“Removing outdated drivers from Windows Update is a proactive measure by Microsoft to ensure the safety and quality of drivers for Windows users,” the developers add. “In the future, we expect that cleanup will become routine, as well as new publishing recommendations, to help all Windows users keep their systems safe and secure.”

In the vast Windows ecosystem, device drivers are not simple support components: they are critical elements that operate at a low level in the system, often with elevated privileges. When they are not updated or remain in an outdated form, they become a perfect blind spot for cybercriminals. In recent years, several ransomware campaigns have exploited vulnerable drivers to bypass EDR protections, disable security services, and gain persistent access. Microsoft knows this, and is taking action.

With the new initiative announced, Redmond has decided to regularly remove outdated drivers from Windows Update, reducing the likelihood that these components end up on users’ systems. But the stakes are high: this is not just a technical choice, it is a preemptive defense strategy. Limiting the distribution of old drivers means closing hidden ports before someone exploits them. A step towards a more secure Windows ecosystem, but also a clear signal to hardware vendors: upgrade or go.

Redazione
The editorial team of Red Hot Cyber consists of a group of individuals and anonymous sources who actively collaborate to provide early information and news on cybersecurity and computing in general.

Lista degli articoli

Articoli in evidenza

“Cleaning Up” Windows Update! Microsoft Declares War on Drivers Exploited in Ransomware Attacks

Microsoft announced that it will periodically remove outdated drivers from the Windows Update Catalog to reduce risk and improve compatibility. “The goal of this initiative is to prov...

FortiGate Under Attack: Tools for Mass Exploitation of Exposed APIs for Sale

A new and alarming development is shaking up the cybersecurity landscape: a malicious actor has advertised on the dark web a highly sophisticated exploit aimed at compromising FortiGate devices. A new...

AKIRA emergency report: the ransomware that is breaching Italy

Spring 2025 will be remembered as a turning point in our country’s cyber chronicle. As bulletins and technical releases follow one another, one fact emerges glaringly: AKIRA has entered the Ita...

RHC GhostSec interview: hacktivism in the shadows of terrorism and cyber conflict

Ghost Security, also known as GhostSec, is a hacktivist group which emerged in the context of the cyber war against Islamic extremism. The first actions of the group date back to the aftermath of the ...

Rivendicato un databreach a Deloitte: credenziali GitHub e codice sorgente finiscono sul dark web

Un attacco informatico ai danni di Deloitte è stato rivendicato dal threat actor “303”, che ha pubblicato su un noto forum underground un post con il titolo inequivocabile...