> Source: [sk175885](https://support.checkpoint.com/results/sk/sk175885)

# sk175885 -  Check Point response to MysterySnail vulnerability

| Property | Value |
|----------|-------|
| Solution ID | sk175885 |
| Date Created | 2021-10-14 |
| Last Modified | 2021-10-20 |
| Technical Level | General |
| Products | Security Gateway, Endpoint Security |
| Versions | R82.10, R82, R81.20, Cloud, R82.20 |

## Solution

On October 13, 2021, details of an exploitation of a vulnerability in Microsoft Windows named "MysterySnail" became publicly known. Microsoft patched the vulnerability in its October 2021 Patch Tuesday.   

The CVE assigned to the vulnerability is [CVE-2021-40449](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40449).   

"MysterySnail" is a remote shell access Trojan installed on compromised Windows servers. "MysterySnail" has privilege escalation, advanced persistence, and data-stealing capabilities. It was recently found at the end of an exploit chain attack campaign by Chinese APT "IronHusky".  

Check Point provides security coverage from the vulnerability with these Threat Prevention protections:  

* **IPS**

Microsoft Win32k Elevation of Privilege (CVE-2021-40449)

* **Anti-Bot**

MysterySnail.TC.\[X\]

* **Anti-Virus**

RAT.Win32.MysterySnail.TC.\[X\]

* **Threat Emulation**

KAV-Trojan.Win64.Agentb.\[X\]  
RAT.Wins.MysterySnail.A

* **Harmony Endpoint**

RAT.Win.MysterySnail.B  
RAT.Win.MysterySnail.C

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content