Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
microsoft windows server 2012 r2 |
||
microsoft windows 10 1607 |
||
microsoft windows 8.1 - |
||
microsoft windows server 2016 - |
||
microsoft windows server 2008 - |
||
microsoft windows server 2008 r2 |
||
microsoft windows 7 - |
||
microsoft windows rt 8.1 - |
||
microsoft windows server 2012 - |
||
microsoft windows 10 - |
||
microsoft windows server 2019 - |
||
microsoft windows 10 1809 |
||
microsoft windows 10 20h2 |
||
microsoft windows 10 21h1 |
||
microsoft windows server 2022 - |
||
microsoft windows 11 - |
||
microsoft windows 10 21h2 |
Advanced persistent threat group Fancy Bear is behind a phishing campaign that uses the specter of nuclear war to exploit a known one-click Microsoft flaw. The goal is to deliver malware that can steal credentials from the Chrome, Firefox and Edge browsers.
The attacks by the Russia-linked APT are tied the Russian and Ukraine war, according to researchers at Malwarebytes Threat Intelligence. They report that Fancy Bear is pushing malicious documents weaponized with the exploit for Follina ...
The Ukrainian Computer Emergency Response Team (CERT) is warning that Russian hacking groups are exploiting the Follina code execution vulnerability in new phishing campaigns to install the CredoMap malware and Cobalt Strike beacons.
The APT28 hacking group is believed to be sending emails containing a malicious document name "Nuclear Terrorism A Very Real Threat.rtf.". The threat actors selected the topic of this email to entice recipients to open it, exploiting the fear that's spread amo...
Ukraine's Computer Emergency Response Team (CERT) is warning that the Russian hacking group Sandworm may be exploiting Follina, a remote code execution vulnerability in Microsoft Windows Support Diagnostic Tool (MSDT) currently tracked as CVE-2022-30190.
The security issue can be triggered by either
and threat actors have been exploiting it in attacks since at least April 2022.
It is worth noting that Ukraine's agency assesses with medium confidence that behind the ...
Symantec has observed threat actors exploiting remote code execution flaw to drop AsyncRAT and information stealer.
Posted: 8 Jun, 20222 Min ReadThreat Intelligence SubscribeFollowtwitterlinkedinAttackers Exploit MSDT Follina Bug to Drop RAT, InfostealerSymantec has observed threat actors exploiting remote code execution flaw to drop AsyncRAT and information stealer.Symantec, a division of Broadcom Software, has observed threat actors exploiting the remote code execution (RCE) vulnerability known as Follina to drop malware onto vulnerable systems just days after the f...
Researchers have added state-sponsored hackers to the list of adversaries attempting to exploit Microsoft’s now-patched Follina vulnerability. According to researchers at Proofpoint, state-sponsored hackers have attempted to abuse the Follina vulnerability in Microsoft Office, aiming an email-based exploit at U.S. and E.U. government targets via phishing campaigns.
Proofpoint researchers spotted the attacks and believe the adversaries have ties to a government, which it did not identify....
At the end of May, researchers from the nao_sec team reported a new zero-day vulnerability in Microsoft Support Diagnostic Tool (MSDT) that can be exploited using Microsoft Office documents. It allowed attackers to remotely execute code on Windows systems, while the victim could not even open the document containing the exploit, or open it in Protected Mode. The vulnerability, which the researchers dubbed Follina, later received the identifier CVE-2022-30190.
CVE-2022-30190 technical detai...
Microsoft has released a workaround for a zero-day flaw that was initially flagged in April and that attackers already have used to target organizations in Russia and Tibet, researchers said.
The remote control execution (RCE) flaw, tracked as CVE-2022-3019, is associated with the Microsoft Support Diagnostic Tool (MSDT), which, ironically, itself collects information about bugs in the company’s products and reports to Microsoft Support.
If successfully exploited, attackers can ins...
Chinese-linked threat actors are now actively exploiting a Microsoft Office zero-day vulnerability (known as 'Follina') to execute malicious code remotely on Windows systems.
This Microsoft Windows Support Diagnostic Tool (MSDT) remote code execution flaw (tracked as
) impacts all Windows client and server platforms still receiving security updates (Windows 7 or later and Windows Server 2008 or later).
Shadow Chaser Group's
, the researcher who first reported the zero-d...
Topics Security Off-Prem On-Prem Software Offbeat Vendor Voice Vendor Voice Resources Data-stealing malware also paired with Black Basta ransomware gang
Miscreants are reportedly exploiting the recently disclosed critical Windows Follina zero-day flaw to infect PCs with Qbot, thus aggressively expanding their reach.
The bot's operators are also working with the Black Basta gang to spread ransomware in yet another partnership in the underground world of cyber-crime, it is claimed.
This combination of Follina exploitation and its use to extort organizations makes the malware an even larger threat for enterprises. Qbot started off as a ...
Topics Security Off-Prem On-Prem Software Offbeat Vendor Voice Vendor Voice Resources Meanwhile Microsoft still hasn't patched the fatal flaw
While enterprises are still waiting for Microsoft to issue a fix for the critical "Follina" vulnerability in Windows, yet more malware operators are moving in to exploit it.
Microsoft late last month acknowledged the remote code execution (RCE) vulnerability – tracked as CVE-2022-30190 – but has yet to deliver a patch for it. The company has outlined workarounds that can be used until a fix becomes available.
In the meantime, reports of active exploits of the flaw continue to sur...
European governments and US local governments were the targets of a phishing campaign using malicious Rich Text Format (RTF) documents designed to exploit a critical Windows zero-day vulnerability known as Follina.
BleepingComputer is aware of local governments in at least two US states that were targeted by this phishing campaign.
"Proofpoint blocked a suspected state aligned phishing campaign targeting less than 10 Proofpoint customers (European gov & local US gov) attempt...
Microsoft has shared mitigation measures to block attacks exploiting a newly discovered Microsoft Office zero-day flaw abused in the wild to execute malicious code remotely.
The bug is a Microsoft Windows Support Diagnostic Tool (MSDT) remote code execution vulnerability reported by
of the
.
Microsoft is now tracking it as
. The flaw impacts all Windows versions still receiving security updates (Windows 7+ and Server 2008+).
A free unofficial patch is now available to block ongoing attacks against Windows systems that target a critical zero-day vulnerability known as 'Follina.'
The bug, now tracked as
and described by Redmond as a Microsoft Windows Support Diagnostic Tool (MSDT) remote code execution flaw, impacts all Windows versions still receiving security updates (Windows 7+ and Server 2008+).
Attackers who successfully exploit this zero-day can execute arbi...
Topics Security Off-Prem On-Prem Software Offbeat Vendor Voice Vendor Voice Resources Plus: Intel, AMD react to Hertzbleed data-leaking holes in CPUs
Patch Tuesday Microsoft claims to have finally fixed the Follina zero-day flaw in Windows as part of its June Patch Tuesday batch, which included security updates to address 55 vulnerabilities.
Follina, eventually acknowledged by Redmond in a security advisory last month, is the most significant of the bunch as it has already been exploited in the wild.
Criminals and snoops can abuse the remote code execution (RCE) bug, tracked as CVE-2022-30190, by crafting a file, such as a Word do...
Vulmon