“Cleaning Up” Windows Update! Microsoft Declares War on Drivers Exploited in Ransomware Attacks | #ransomware | #cybercrime

Redazione RHC : 24 June 2025 08:06

Microsoft announced that it will periodically remove outdated drivers from the Windows Update Catalog to reduce risk and improve compatibility. “The goal of this initiative is to provide the best set of drivers on Windows Update for the various hardware solutions in the Windows ecosystem and help keep Microsoft Windows secure,” the company said in a statement.

Microsoft also added that “This initiative will periodically clean up drivers on Windows Update, which will result in some drivers not being deployed on systems in our ecosystem.” As the company has clarified, the first phase of the “cleanup” procedure will affect drivers for which Windows Update already has newer alternatives.

With “cleanup” Microsoft intends to remove expired drivers from Windows Update, so that they are no longer offered on any Windows system. This will be achieved by removing the corresponding assignments of the old drivers in the Hardware Development Center. It should also be noted that in the future Microsoft will expand the list of categories that can be excluded from Windows Update for security reasons. Please note that partners will still be able to republish drivers removed by Microsoft if they provide a business justification for doing so.

“Removing outdated drivers from Windows Update is a proactive measure by Microsoft to ensure the safety and quality of drivers for Windows users,” the developers add. “In the future, we expect that cleanup will become routine, as well as new publishing recommendations, to help all Windows users keep their systems safe and secure.”

In the vast Windows ecosystem, device drivers are not simple support components: they are critical elements that operate at a low level in the system, often with elevated privileges. When they are not updated or remain in an outdated form, they become a perfect blind spot for cybercriminals. In recent years, several ransomware campaigns have exploited vulnerable drivers to bypass EDR protections, disable security services, and gain persistent access. Microsoft knows this, and is taking action.

With the new initiative announced, Redmond has decided to regularly remove outdated drivers from Windows Update, reducing the likelihood that these components end up on users’ systems. But the stakes are high: this is not just a technical choice, it is a preemptive defense strategy. Limiting the distribution of old drivers means closing hidden ports before someone exploits them. A step towards a more secure Windows ecosystem, but also a clear signal to hardware vendors: upgrade or go.