Senator Ron Wyden (D-OR) has written to Andrew Ferguson, Chair of the Federal Trade Commission (FTC), requesting the FTC investigate Microsoft and hold it responsible for “gross cybersecurity negligence,” which Sen. Wyden believes has contributed to the barrage of ransomware attacks on critical infrastructure entities.

In the letter, Sen. Wyden cites figures from a February 2025 report published by the Director of National Intelligence (DNI) indicating more than 5,000 ransomware attacks in 2024, a 15% increase from 2024, and a 103% increase from 2022. Around half of the victims of those attacks are located in the United States. Those attacks have caused enormous harm to healthcare providers, put patient care at risk, and pose a continuing threat to national security.

Sen. Wyden believes Microsoft is at fault for many of these attacks because of its de facto monopoly on operating systems, combined with dangerous software engineering decisions that have made the Windows operating system vulnerable to ransomware attacks. Sen. Wyden explained that Microsoft chooses the security measures enabled by default in the Windows operating system, and while any user can alter the settings, many do not, as they are unaware of the risks associated with the default security settings.

Cybersecurity Vulnerability Exploited in Ascension Ransomware Attack

Sen Wyden used the 2024 hack of Ascension, one of the largest health systems in the United States, as an example of how easy it is for ransomware groups to breach the networks of critical infrastructure entities. The ransomware group gained access to privileged accounts on Ascension’s Active Directory Server using a privilege escalation technique called kerberoasting, after an Ascension contractor clicked a malicious link in a Bing search result on an Ascension laptop and inadvertently downloaded malware.

The malware provided the attacker with initial access, they moved laterally, and gained administrative privileges to the Microsoft Active Directory Server. The attacker exfiltrated data, then used ransomware to encrypt files. The electronic protected health information of 5.6 million patients was compromised in the attack. The attack was made possible due to a long-standing post-exploitation vulnerability.

Kerberoasting is an attack technique that exploits Microsoft’s continued support for an insecure encryption technology – RC4 – from the 1980s. Microsoft is well aware of the risk from kerberoasting, and how it can be exploited to obtain Active Directory credentials. For more than a decade, cybersecurity experts have warned of the dangers of kerberoasting, yet no action has been taken by Microsoft to mitigate the threat, even though more secure methods of encryption are supported by Windows.

The Advanced Encryption Standard (AES) is vastly superior to RC4, is supported by Windows, and recommended by the U.S. government, yet Microsoft does not use AES by default in Windows. The result of that software engineering decision is that hackers with access to a corporate network can exploit the weaknesses in RC4 encryption technology to crack administrators’ privileged accounts.

Sen. Wyden said Microsoft has stated that the risk can be mitigated by setting long passwords of 14 or more characters, yet Microsoft does not require passwords of that length to be set for privileged accounts by default. Sen. Wyden wrote to Microsoft in July 2024, warning about the threat of kerberoasting, and in October 2024, Microsoft published a blog post warning about the vulnerability and how the threat can be mitigated. Microsoft also promised to issue a software update to fix the issue. Almost a year on, and no fix has been forthcoming. Also in October 2024, the Cybersecurity and Infrastructure Security Agency (CISA) issued a warning that Iranian hackers were using the kerberoasting technique to attack U.S. organizations.

Despite the technique being used by threat actors, the warning was added to an obscure part of its website and was not promoted. Rather than issue a prominent and easy-to-read warning as requested by Sen. Wyden, the blog post was highly technical in nature. As a result, many companies may not have seen the post or acted on the advice, leaving their crown jewels – Active Directory credentials – at risk.

FTC Action Required to Force Microsoft to Provide Secure Software by Default

Kerberoasting is just one technique that can be used to exploit vulnerabilities. Sen. Wyden provided further examples of Microsoft’s cybersecurity failures that have been exploited by nation-state actors to attack Microsoft customers, including attacks by China in 2023 and, more recently, the vulnerability in Microsoft SharePoint that was mass exploited by hackers linked to the Chinese government this year.

“There is one company benefiting from this status quo: Microsoft itself. Instead of delivering secure software to its customers, Microsoft has built a multibillion-dollar secondary business selling cybersecurity add-on services to those organizations that can afford it,” Sen. Wyden wrote in the letter. “At this point, Microsoft has become like an arsonist selling firefighting services to their victims. And yet government agencies, companies, and nonprofits like Ascension have no choice but to continue to use the company’s software, even after they are hacked, because of Microsoft’s near-monopoly over enterprise IT.”

Sen. Wyden believes that the FTC should take action to hold Microsoft to account, and if no action is taken, Microsoft is likely to continue to deliver dangerous, insecure software to critical infrastructure entities and the government, and further attacks are inevitable.

The post Sen. Wyden Urges FTC to Take Action Against Microsoft for “Gross Cybersecurity Negligence” appeared first on The HIPAA Journal.