More than a month after Microsoft issued an emergency patch for a Windows vulnerability that allows for self-replicating exploits, researchers have spotted a wave of new attacks in the wild that target the critical flaw.

Exploits of MS08-067 have been reported on and off since Microsoft issued the patch in late October, but over the past week, the volume and sophistication of the attacks have grown, according to Ziv Mador, a researcher in Microsoft's Malware Protection Center. His assessment was echoed in reports issued this week by anti-virus providers McAfee and Symantec, the latter which ratcheted up its ThreatCon alert level as a result.

The worm is notable because once it takes hold of a machine it patches the vulnerability to prevent competing attackers from taking hold of the same valuable resource. Infection reports are coming mostly from the US, but other regions, including Western Europe, Japan, China and Brazil, are also affected. Conficker.A avoids infecting PCs based in Ukraine, which is presumably where the attackers are based.

MS08-067 is among the more critical vulnerabilities to hit Windows because on XP versions and earlier a single successful attack can touch off a chain reaction in which other machines on the same network are also compromised. The threat posed by the flaw was so severe Microsoft took the unusual step of issuing an emergency patch outside of its normal update cycle.

It's not surprising that bad guys would target a hole as nasty and gaping as MS08-067. What we still can't fathom is why anyone hasn't yet installed the patch. We're not ones to blame the victim, but anyone attacked by Conficker deserves a generous portion of the responsibility. ®

Related stories

• Updated Leaked memo says Conficker pwns Parliament (27 March 2009)
• Final countdown to Conficker 'activation' begins (26 March 2009)
• Conficker call-backs threaten to swamp legit domains (2 March 2009)
• Conficker variant dispenses with need to phone home (23 February 2009)
• MS puts up $250K bounty for Conficker author (12 February 2009)
• Houston justice system laid low by Conficker worm (9 February 2009)
• ASProx botnet dials into Conficker domains (3 February 2009)
• Conficker botnet growth slows at 10m infections (26 January 2009)
• Countdown to Conficker activation begins (23 January 2009)
• Exclusive Conficker seizes city's hospital network (20 January 2009)
• Three in 10 Windows PCs still vulnerable to Conficker exploit (19 January 2009)
• Prolific worm infects 3.5m Windows PCs (15 January 2009)
• Windows RPC exploit spawns bots and worms (4 November 2008)
• Microsoft: Malware for Windows on the rise (3 November 2008)
• Trojan attacks Microsoft's emergency patch vuln (24 October 2008)
• Updated Microsoft rushes out emergency Windows security fix (23 October 2008)
• Microsoft's Patch Tuesday plugs critical holes in IE, Office (15 October 2008)
• Malware removes rival rootkits (28 February 2008)