The “Unpatchable” Ghost: How PhantomRPC Turns Windows Architecture Against Itself for SYSTEM Control

Security researchers at Kaspersky Lab have identified a surreptitious methodology within Windows to obtain absolute systemic hegemony—a vulnerability for which a remediation remains notably absent. By merely impersonating a specific system service, an adversary can compel the machine to relinquish SYSTEM-level privileges autonomously.

The flaw resides within the Remote Procedure Call (RPC) mechanism, the quintessential architecture in Windows responsible for inter-process communication. Through this framework, applications and services invoke functions across disparate contexts. This labyrinthine system has a long-standing reputation as a prolific source of security complications.

The nascent research delineates a structural vulnerability within this architecture. The exploit facilitates Privilege Escalation to the highest tier, provided the process possesses the requisite “impersonation” rights. Such permissions are inherently granted to various service accounts, including network services. Despite Microsoft being formally apprised of the flaw, the corporation has refrained from issuing a patch, designating the risk as merely “moderate.”

The essence of the assault is deceptively elegant. Within Windows, numerous services commune via RPC; should a requisite service be dormant, the system nonetheless attempts a connection, culminating in an error. At this precise juncture, an interloper can introduce a fraudulent server utilizing the identical interface to “intercept” the request.

Subsequently, a specific nuance of the impersonation mechanism is triggered: a server may temporarily adopt the security context of the client that initiated the connection. Should that client be a system service or an administrative entity, the adversary inherits those exact credentials.

One illustrative scenario involves the Group Policy service. During configuration updates, it endeavors to communicate with the Remote Desktop Service. If the latter is deactivated, the request is susceptible to interception. The fraudulent server accepts the connection and “assumes” SYSTEM-level authority. Consequently, the adversary elevates their stature from a mere network service to the zenith of systemic control.

An analogous stratagem operates without direct coercion. For instance, the Microsoft Edge browser initiates such a request upon launch; an adversary need only wait for an administrator to open the browser for the malicious server to procure their rights. Furthermore, entirely automated variants exist: certain background system services periodically attempt to contact the Remote Desktop Service. In this instance, the aggressor simply awaits the inevitable moment the system surrenders the coveted request.

Another manifestation targets the DHCP client. By disabling the corresponding service and substituting its interface, the execution of a standard ipconfig command causes administrative rights to migrate to the adversary. Similar logic applies to the Windows Time service, where the utility initially attempts to connect to a non-existent channel that can be readily occupied.

The predicament is more profound than it initially appears. Windows fails to verify the authenticity of the RPC server accepting the request; any process can instantiate a service with the requisite nomenclature and interface. Given the ubiquity of RPC within the operating system, the potential attack surface is vast.

To identify these vulnerabilities, specialists scrutinized system logs to track unsuccessful RPC inquiries. Of particular interest are instances where a high-privilege process attempts to interface with a non-existent service that permits impersonation. Each such failure represents a potential portal for ingress.

A comprehensive resolution is impossible without a fundamental architectural overhaul. Currently, mitigation is limited to risk reduction: for example, activating dormant services to eliminate “vacant” connection points and restricting the dissemination of impersonation rights among unnecessary processes. The vulnerability was verified on Windows Server 2022 and Windows Server 2025 with the latest security updates, though the underlying architecture suggests it plagues other iterations of Windows as well.