PhantomRPC: A New Windows RPC Privilege Escalation Technique

Security researchers at Kaspersky have uncovered PhantomRPC, an architectural-level vulnerability in Windows Remote Procedure Call that lets attackers deploy a fake RPC server and escalate privileges from low-privileged contexts to SYSTEM or Administrator — without requiring a classic memory-corruption bug.

In the world of Windows exploitation, attackers usually hunt for "bugs": a buffer overflow, a race condition, or a logic error in a specific driver. However, newly disclosed research from Kaspersky Application Security Specialist Haidar Kabibo, presented at Black Hat Asia 2026 on April 24, 2026, has exposed something much more difficult to patch: a structural design consequence.

Dubbed PhantomRPC, this technique allows an attacker who has already gained a "foothold" on a system — specifically through low-privileged service accounts like NETWORK SERVICE or LOCAL SERVICE — to vault themselves to the highest level of authority on a machine: NT AUTHORITY\SYSTEM.

The Core Mechanism: The "Fake Server" Trap

Remote Procedure Call (RPC) is the backbone of Windows communication, allowing different processes to talk to one another. Under normal circumstances, a client process (like an updater or a diagnostic tool) reaches out to a legitimate RPC server (like the Terminal Services API).

PhantomRPC exploits the behavior of the RPC runtime when a legitimate server is unavailable. The attack chain works as follows:

1. Deployment: An attacker with a low-privileged process deploys an attacker-controlled RPC server that mimics a legitimate, but currently inactive, RPC endpoint.
2. The Coercion: A high-privileged process (such as a Group Policy update or a Windows Defender diagnostic) attempts to contact the real service.
3. The Interception: Because the real service is unavailable, the Windows RPC runtime inadvertently connects to the attacker's fake server instead.
4. Impersonation: The attacker-server uses the legitimate RpcImpersonateClient() function to assume the security context of the high-privileged caller, instantly granting the attacker SYSTEM or Administrator access.

Five Known Escalation Paths

Kaspersky researchers identified five distinct vectors where this architectural weakness can be weaponized today:

• Group Policy (gpupdate): Triggering gpupdate /force as a user causes the Group Policy Client (SYSTEM) to call Terminal Services. If the service is disabled, the fake RPC endpoint responds and steals the SYSTEM token.
• Microsoft Edge: The browser's startup path triggers RPC calls that can be intercepted to elevate a NETWORK SERVICE process to a full local Administrator.
• Windows Defender (WDI): Periodic diagnostic calls can be intercepted to gain SYSTEM access without any user interaction.
• DHCP Client: A path from LOCAL SERVICE to Administrator through ipconfig-triggered RPC calls.
• Background Services: Kaspersky notes the attack surface is effectively unbounded; any background service that acts as an RPC client to an unavailable endpoint is a potential target.

Affected Versions: Tested Versus Assessed

Coverage describing PhantomRPC as affecting "all Windows versions" overstates what the research actually demonstrates, and the distinction matters for anyone scoping their own exposure. Kaspersky is explicit: every exploit described in the research was tested on Windows Server 2022 and Windows Server 2025, running the latest updates available before the report was submitted. Exploitability on other supported Windows versions is an assessment, not a demonstrated result — the researchers write only that it is "highly likely that this issue may also be exploitable on other Windows versions." Because the weakness is architectural, the exact exploitation path varies from machine to machine depending on installed software, the DLLs involved in RPC communication, and which legitimate RPC servers happen to be running.

Microsoft's Response and Patch Status

Kaspersky reported the issue to the Microsoft Security Response Center in September 2025. Microsoft replied roughly three weeks later, classifying it as moderate severity on the grounds that a successful attack requires the originating process to already hold SeImpersonatePrivilege. On that basis, Microsoft determined the issue did not require immediate remediation. No CVE was assigned and the case was closed without further tracking. All five exploitation paths therefore remain unpatched — and because this is an architectural design weakness rather than a defect in one faulty component, there is no single fix for administrators to apply.

What Defenders Can Do Now

PhantomRPC is a post-compromise escalation concern, not an initial-access one. By Microsoft's own reasoning, an attacker must already be running inside a process that holds impersonation rights before any of this becomes usable — which narrows the exposure but does not remove it. With no patch available, the practical work is detection and privilege hygiene.

• Monitor RPC exceptions with ETW. Kaspersky's recommended detection approach is ETW-based monitoring that surfaces RPC exceptions in the environment — specifically, cases where an RPC client attempts to connect to a server that is not running. Those events are the tell that a legitimate endpoint is expected but absent.
• Close the vacancies attackers would fill. Where that monitoring shows a legitimate RPC server is expected but not running, enabling the corresponding service reduces the attack surface: an attacker cannot pose as an endpoint that is already occupied.
• Restrict and audit SeImpersonatePrivilege. Kaspersky advises reducing use of the privilege in processes that do not need it. Some system processes legitimately require it; granting it to custom or third-party processes is generally not good security practice.
• Inventory which accounts hold impersonation rights. Because that privilege is the precondition for the entire technique, an accurate inventory of the accounts and services carrying it is the fastest way to size your real exposure — and the shortest list of things to tighten.

The CyberSignal Analysis: Strategic Signals

Signal 01 — Architecture is the New Exploit Surface

PhantomRPC represents a shift in researcher and attacker focus. Instead of looking for a "one-off" bug in an obscure driver, they are targeting core Windows security architecture. Because this is a design behavior rather than a simple coding error, there is no single component to fix — which is exactly why Microsoft's moderate-severity call leaves defenders relying on monitoring and privilege hygiene instead of a patch.

Signal 02 — "Coercion" Without Interaction

Most modern privilege escalation requires a user to click a link or run a specific file. PhantomRPC vectors like WDI and Group Policy happen automatically in the background. This makes it a perfect tool for post-exploitation lateral movement where stealth is paramount.

Signal 03 — The "Low-Privilege" Jump-Point

This research highlights that NETWORK SERVICE and LOCAL SERVICE accounts — often viewed by defenders as "contained" — are actually high-risk jump-points. This follows a trend we've seen in kernel-driver abuse, where low-level system access is systematically converted into total environmental control.

Sources