Saturday, February 15, 2025
HomeCyber AttackThreat Actors Exploit Microsoft 'Follina' Bug to Attack Europe and U.S. Entities

Threat Actors Exploit Microsoft ‘Follina’ Bug to Attack Europe and U.S. Entities

Published on

SIEM as a Service

Follow Us on Google News

The recently disclosed vulnerability in Microsoft Office, known as Follina has been exploited by state-sponsored hackers. They did so to target the alleged entities from the following regions:-

  • Europe
  • The U.S.

On May 31, Microsoft released workarounds for a zero-day vulnerability that has been discovered recently and known as “Follina.” 

At the time of its discovery, this vulnerability didn’t receive the tracking number. However, this time the tracking number of this vulnerability has been assigned:-

  • CVE-2022-30190 with CVSS score 7.8

Here’s what the advisory published by Microsoft states:-

“Recently, Microsoft released a security bulletin regarding a vulnerability related to the Microsoft Support Diagnostic Tool (MSDT) in Windows, which it assigned the CVE-2022-30190.”

Attack chain

It should be noted that MSDT uses the URL protocol when interacting with a calling application like Word, thereby posing a remote code execution vulnerability. 

When this vulnerability is exploited, a successful attacker will be able to execute arbitrary code with full privileges as if the calling application was themselves. 

In the context allowed by the user’s rights, the attacker can at this point install programs, create accounts, view, edit, delete data, or change data that has been stored.

Having sent more than 1,000 phishing emails containing a lure document, what makes this attack far more devastating. An RTF (242d2fa02535599dae793e731b6db5a2) containing the exploit payload was used in this campaign that masqueraded as a salary increase and connected to 45.76.53[.253] for downloading the exploit payload.

Payloads, which are manifested as PowerShell scripts, are Base64-encoded so that they are transmissible. This PowerShell script is being downloaded from a remote server called “seller-notification[.]live,” in short, this script functions as a downloader.

In a recent report, Proofpoint researchers have claimed that the China-linked APT group TA413 generally uses the weaponized Word documents with ZIP archives against spear-phishing victims.

In the attacks, the attackers use the domain tibet-gov.web[.]app in order to simulate the Women Empowerments Desk of the “Central Tibetan Administration.”

With exploits for the Follina vulnerability, less than 10 Proofpoint customers from the European and local US governments have been targeted.

At the present time, the exploit mainly affects the older versions of Microsoft Office: – 

  • Microsoft Office 2013
  • Microsoft Office 2016

While the further investigation indicates that the flaw affects even the latest versions of Microsoft Office as well.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Fake BSOD Attack Launched via Malicious Python Script

A peculiar malicious Python script has surfaced, employing an unusual and amusing anti-analysis trick...

SocGholish Malware Dropped from Hacked Web Pages using Weaponized ZIP Files

A recent wave of cyberattacks leveraging the SocGholish malware framework has been observed using...

Lazarus Group Targets Developers Worldwide with New Malware Tactic

North Korea's Lazarus Group, a state-sponsored cybercriminal organization, has launched a sophisticated global campaign...

North Korean IT Workers Penetrate Global Firms to Install System Backdoors

In a concerning escalation of cyber threats, North Korean IT operatives have infiltrated global...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

SocGholish Malware Dropped from Hacked Web Pages using Weaponized ZIP Files

A recent wave of cyberattacks leveraging the SocGholish malware framework has been observed using...

Lazarus Group Targets Developers Worldwide with New Malware Tactic

North Korea's Lazarus Group, a state-sponsored cybercriminal organization, has launched a sophisticated global campaign...

North Korean IT Workers Penetrate Global Firms to Install System Backdoors

In a concerning escalation of cyber threats, North Korean IT operatives have infiltrated global...