Threat Actors Exploit Microsoft ‘Follina’ Bug to Attack Europe and U.S. Entities

The recently disclosed vulnerability in Microsoft Office, known as Follina has been exploited by state-sponsored hackers. They did so to target the alleged entities from the following regions:-

• Europe
• The U.S.

On May 31, Microsoft released workarounds for a zero-day vulnerability that has been discovered recently and known as “Follina.” 

At the time of its discovery, this vulnerability didn’t receive the tracking number. However, this time the tracking number of this vulnerability has been assigned:-

• CVE-2022-30190 with CVSS score 7.8

Here’s what the advisory published by Microsoft states:-

“Recently, Microsoft released a security bulletin regarding a vulnerability related to the Microsoft Support Diagnostic Tool (MSDT) in Windows, which it assigned the CVE-2022-30190.”

Attack chain

It should be noted that MSDT uses the URL protocol when interacting with a calling application like Word, thereby posing a remote code execution vulnerability. 

When this vulnerability is exploited, a successful attacker will be able to execute arbitrary code with full privileges as if the calling application was themselves. 

In the context allowed by the user’s rights, the attacker can at this point install programs, create accounts, view, edit, delete data, or change data that has been stored.

Having sent more than 1,000 phishing emails containing a lure document, what makes this attack far more devastating. An RTF (242d2fa02535599dae793e731b6db5a2) containing the exploit payload was used in this campaign that masqueraded as a salary increase and connected to 45.76.53[.253] for downloading the exploit payload.

Payloads, which are manifested as PowerShell scripts, are Base64-encoded so that they are transmissible. This PowerShell script is being downloaded from a remote server called “seller-notification[.]live,” in short, this script functions as a downloader.

In a recent report, Proofpoint researchers have claimed that the China-linked APT group TA413 generally uses the weaponized Word documents with ZIP archives against spear-phishing victims.

In the attacks, the attackers use the domain tibet-gov.web[.]app in order to simulate the Women Empowerments Desk of the “Central Tibetan Administration.”

With exploits for the Follina vulnerability, less than 10 Proofpoint customers from the European and local US governments have been targeted.

At the present time, the exploit mainly affects the older versions of Microsoft Office: – 

• Microsoft Office 2013
• Microsoft Office 2016

While the further investigation indicates that the flaw affects even the latest versions of Microsoft Office as well.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.