ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
CyberScooppublished ()ingested @AJVicens

Ukrainian cybersecurity officials disclose two new hacking campaigns

criticalThreat actor exploited in the wildimportance 60CVE-2022-30190
Read the original
Tagscve-2022-30190threat-actor

Vulnerabilities mentionedAll →

CVEVulnerabilityCVSSEPSSFlagsAffectedExposurePublished
CVE-2022-30190
MSDT URL Protocol Remote Code Execution in Microsoft Windows (Follina)

CVE-2022-30190 (Follina) is a remote code execution flaw in the Microsoft Windows Support Diagnostic Tool (MSDT) when MSDT is invoked through its ms-msdt URL protocol by a calling application such as Microsoft Word. Attackers trigger it by luring a user into opening a malicious document — typically a Word/RTF file whose link or remotely linked template launches the ms-msdt: URI with attacker-supplied commands — and CVSS 3.1 rates it 7.8 with a local attack vector and required user interaction. A successful exploit runs arbitrary code with the privileges of the calling application, allowing the attacker to install programs, view, change or delete data, or create new accounts in the user's context. Per the CISA data, affected platforms are Windows 7, 8.1 and RT 8.1, Windows 10 versions 1507 through 21H2, Windows 11 21H2, and Windows Server 2008 and 2012 — essentially any Windows installation that ships MSDT, with Office/Word as the common delivery vector. Exploitation is confirmed in the wild: Microsoft acknowledged it as an exploited zero-day, CISA added it to the KEV on 2022-06-14 with known ransomware use, EPSS puts the 30-day exploitation probability at 99.2% (99th percentile), and contemporaneous reporting also tied its use to espionage actors including APT28.

Do: Apply Microsoft's security updates per vendor instructions (the fix shipped in the June 2022 Patch Tuesday releases for the affected Windows versions), as required by CISA's KEV. If patching must be delayed, follow Microsoft's documented mitigation to disable the MSDT URL protocol (remove or restrict the HKEY_CLASSES_ROOT\ms-msdt registry key) and enforce Office Protected View / block Word from fetching remote templates over the network. Hunt for exploitation by checking whether Office processes (WINWORD.exe) launch msdt.exe or sdiagnhost.exe, or whether ms-msdt: URIs are invoked unexpectedly.

7.899% KEV ransomware PoC
  • Microsoft Windows 10 1507, 1607, 1809, 20H2, 21H1, 21H2
  • Microsoft Windows 11 21H2
  • Microsoft Windows 7
  • +4 more
mass≈1 billion+ Windows devices (effectively the entire supported Windows installed base)
Full article572 words · extracted from cyberscoop.com · click to collapse
Skip to main content

Get our latest cybersecurity news first on Google.

Click here!

Both efforts relied on malicious documents, officials said.

A general view over the Kyiv skyline and residential buildings after sunset during a curfew on Feb., 2022 in Kyiv, Ukraine. (Photo by Chris McGrath/Getty Images)

Ukrainian cybersecurity officials exposed two new hacking campaigns against targets there this week, one using a phony tax collection document purportedly sent by the national tax agency and the other using a malicious document that discussed the threat of nuclear attack from Russia.

Officials with the Computer Emergency Response Team of Ukraine (CERT-UA) published the first notice Monday warning of malicious Microsoft Word document titled “Imposition of penalties” distributed by email supposedly from the State Tax Service of Ukraine. If opened, the document would attempt to load a Cobalt Strike Beacon, which could give an attacker a connection to a target system and potentially enable malicious behavior.

The malicious document was compiled June 16, the officials said. They attributed the activity to a group tracked as UAC-0098, which has been blamed for other attacks on Ukrainian entities in the wake of the Russian attack Feb. 24 and shows possible links to TrickBot, a well-known malware variant associated with various Russian cybercrime groups.

Ukraine’s State Service of Special Communications and Information Protection said in a statement on its website that the campaign targeted unspecified critical infrastructure within Ukraine.

The other attack, which CERT-UA detailed in a notice published Monday, used malicious code in a text file that sought to launch the CredoMap malware.

“According to the set of characteristic features, we consider it possible to associate the detected activity with the activities of the APT28 group,” the agency said. APT28, known widely as Fancy Bear, is a prolific Russian military intelligence hacking crew.

The attack exploited a remote code execution vulnerability tracked as CVE-2022-30190 and dubbed “Follina” that would allow an attacker to take control of an affected system, the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency warned in a May 31 notice.

Image of the document associated with a recent APT28 hacking campaign in Ukraine (CERT-UA).

Metadata associated with the file indicates the document was last modified June 9, suggesting its distribution may have begun June 10, CERT-UA said.

Latest Podcasts

Text extracted automatically; images, tables and formatting may be missing. Original: https://cyberscoop.com/ukraine-russia-hacking-apt28-trickbot-follina/