Friday, April 25, 2025
HomeCyber AttackThreat Actors Exploit Microsoft 'Follina' Bug to Attack Europe and U.S. Entities

Threat Actors Exploit Microsoft ‘Follina’ Bug to Attack Europe and U.S. Entities

Published on

SIEM as a Service

Follow Us on Google News

The recently disclosed vulnerability in Microsoft Office, known as Follina has been exploited by state-sponsored hackers. They did so to target the alleged entities from the following regions:-

  • Europe
  • The U.S.

On May 31, Microsoft released workarounds for a zero-day vulnerability that has been discovered recently and known as “Follina.” 

At the time of its discovery, this vulnerability didn’t receive the tracking number. However, this time the tracking number of this vulnerability has been assigned:-

  • CVE-2022-30190 with CVSS score 7.8
- Advertisement - Google News

Here’s what the advisory published by Microsoft states:-

“Recently, Microsoft released a security bulletin regarding a vulnerability related to the Microsoft Support Diagnostic Tool (MSDT) in Windows, which it assigned the CVE-2022-30190.”

Attack chain

It should be noted that MSDT uses the URL protocol when interacting with a calling application like Word, thereby posing a remote code execution vulnerability. 

When this vulnerability is exploited, a successful attacker will be able to execute arbitrary code with full privileges as if the calling application was themselves. 

In the context allowed by the user’s rights, the attacker can at this point install programs, create accounts, view, edit, delete data, or change data that has been stored.

Having sent more than 1,000 phishing emails containing a lure document, what makes this attack far more devastating. An RTF (242d2fa02535599dae793e731b6db5a2) containing the exploit payload was used in this campaign that masqueraded as a salary increase and connected to 45.76.53[.253] for downloading the exploit payload.

Payloads, which are manifested as PowerShell scripts, are Base64-encoded so that they are transmissible. This PowerShell script is being downloaded from a remote server called “seller-notification[.]live,” in short, this script functions as a downloader.

In a recent report, Proofpoint researchers have claimed that the China-linked APT group TA413 generally uses the weaponized Word documents with ZIP archives against spear-phishing victims.

In the attacks, the attackers use the domain tibet-gov.web[.]app in order to simulate the Women Empowerments Desk of the “Central Tibetan Administration.”

With exploits for the Follina vulnerability, less than 10 Proofpoint customers from the European and local US governments have been targeted.

At the present time, the exploit mainly affects the older versions of Microsoft Office: – 

  • Microsoft Office 2013
  • Microsoft Office 2016

While the further investigation indicates that the flaw affects even the latest versions of Microsoft Office as well.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Chrome UAF Process Vulnerabilities Actively Exploited

Security researchers have revealed that two critical use-after-free (UAF) vulnerabilities in Google Chrome’s Browser...

Microsoft Defender XDR False Positive Leaked Massive 1,700+ Sensitive Documents to Publish

An alarming data leak involving Microsoft Defender XDR has exposed more than 1,700 sensitive...

‘SessionShark’ – A New Toolkit Bypasses Microsoft Office 365 MFA Security

Security researchers have uncovered a new and sophisticated threat to Microsoft Office 365 users:...

Hackers Exploit MS-SQL Servers to Deploy Ammyy Admin for Remote Access

A sophisticated cyberattack campaign has surfaced, targeting poorly managed Microsoft SQL (MS-SQL) servers to...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Hackers Exploit MS-SQL Servers to Deploy Ammyy Admin for Remote Access

A sophisticated cyberattack campaign has surfaced, targeting poorly managed Microsoft SQL (MS-SQL) servers to...

New Report Reveals How AI is Rapidly Enhancing Phishing Attack Precision

The Zscaler ThreatLabz 2025 Phishing Report unveils the alarming sophistication of modern phishing attacks,...

159 CVEs Exploited in the Wild in Q1 2025, 8.3% Targeted Within 1-Day Vulnerabilities Exploited

VulnCheck's latest report for Q1 2025 has identified 159 Common Vulnerabilities and Exposures (CVEs)...