Wyden Urges FTC to Investigate Microsoft Over Weak RC4 Encryption Enabling Kerberoasting

Wyden has formally requested the Federal Trade Commission investigate Microsoft for cybersecurity negligence that allegedly enabled ransomware attacks against critical infrastructure, in a letter dated 10 September 2025. The inquiry focuses on Microsoft’s software decisions around RC4, a deprecated encryption technology, and how Kerberoasting could be used to escalate privileges in Active Directory aboard Ascension’s network.

According to Wyden’s findings, the 2024 ransomware attack against Ascension began when an contractor clicked a malicious link while using Microsoft’s Bing search engine through the Edge browser, compromising thousands of computers and exposing data belonging to 5.6 million patients. The piece notes that Kerberoasting exploits rely on RC4 being still supported by default, despite Microsoft offering Advanced Encryption Standard as a selectable option.

Wyden criticises Microsoft for a lack of timely public guidance, stating a technical blog post in October 2024 and a promised security update to disable RC4 had not been delivered eleven months later. The matter has drawn attention from multiple U.S. cybersecurity agencies, which have previously warned about Kerberoasting in healthcare and other sectors.