CVE-2023-23397
published 2023-03-14CVE-2023-23397: Microsoft Outlook Elevation of Privilege Vulnerability
PriorityP197critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2023-04-04
Exploited in the wild
EPSS
97.41%
99.9th percentile
Microsoft Outlook Elevation of Privilege Vulnerability
Affected
36 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_365_apps_for_enterprise | >= 16.0.1 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_office_2019 | >= 19.0.0 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_office_ltsc_2021 | >= 16.0.1 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_outlook_2013_service_pack_1 | >= 15.0.0.0 < 15.0.5537.1000 | 15.0.5537.1000 |
| microsoft | microsoft_outlook_2016 | >= 16.0.0.0 < 16.0.5387.1000 | 16.0.5387.1000 |
| microsoft | office | — | — |
| microsoft | office_long_term_servicing_channel | — | — |
| microsoft | outlook | — | — |
| microsoft | outlook | — | — |
| msrc | microsoft_365_apps_for_enterprise_for_32-bit_systems | — | — |
| msrc | microsoft_365_apps_for_enterprise_for_64-bit_systems | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_23 | — | — |
| msrc | microsoft_exchange_server_2019_cumulative_update_13 | — | — |
| msrc | microsoft_exchange_server_2019_cumulative_update_14 | — | — |
| msrc | microsoft_office_2019_for_32-bit_editions | — | — |
| msrc | microsoft_office_2019_for_64-bit_editions | — | — |
| msrc | microsoft_office_ltsc_2021_for_32-bit_editions | — | — |
| msrc | microsoft_office_ltsc_2021_for_64-bit_editions | — | — |
| msrc | microsoft_outlook_2013_rt_service_pack_1 | — | — |
| msrc | microsoft_outlook_2013_service_pack_1 | — | — |
| msrc | microsoft_outlook_2016 | — | — |
| msrc | windows_10 | — | — |
| msrc | windows_10_version_1607 | — | — |
| msrc | windows_10_version_1809 | — | — |
| msrc | windows_10_version_20h2 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Block outbound TCP/445 (SMB) at the network perimeter to prevent Net-NTLMv2 hash exfiltration triggered by CVE-2023-23397 exploit emails. ↗
- →The exploit is triggered when Outlook processes a specially crafted email containing a UNC path in an extended MAPI property pointing to an attacker-controlled SMB share — no user interaction or Preview Pane opening is required. ↗
- →The NTLM hash leak fires when the Outlook reminder window is displayed; an already-expired reminder fires immediately upon receipt, so detection should also cover immediate outbound SMB connections upon email arrival. ↗
- →Pawn Storm used compromised EdgeOS routers as SMB callback servers (port 445) for CVE-2023-23397 exploits, combined with SOCKS5 proxies on port 56981 and Werkzeug/Waitress implants on port 8080 — hunt for outbound SMB to EdgeOS router IPs. ↗
- →A PowerShell-based Net-NTLMv2 hash stealer (SHA256: 52951f2d92e3d547bad86e33c1b0a8622ac391c614efa3c5d167d8a825937179) spawns two background processes sending requests to localhost:8080 to trigger NTLMv2 authentication via WebDAV and then exfiltrates the AUTHENTICATE message to mockbin.org. ↗
- →The patch (CVE-2023-23397 fix) can be bypassed via CVE-2023-29324 by forging the malicious UNC path in a particular format; ensure the May 2023 patch is also applied and monitor Exchange-side stripping of extended MAPI properties. ↗
- →Malicious samples arrive as MSG, EML, or TNEF-format attachments; hunt for TNEF attachments containing calendar/task objects with UNC paths in extended MAPI properties pointing to external IPs. ↗
- ·The vulnerability only leaks Net-NTLMv2 hashes via SMB (port 445); WebDAV fallback does NOT leak credentials to external entities because Windows honors internet security zone checks for WebDAV. ↗
- ·Microsoft-hosted online services (e.g., Microsoft 365 / Outlook on the web) are NOT affected; only self-hosted/on-premises Outlook for Windows (2013 through current) is vulnerable. ↗
- ·The leaked Net-NTLMv2 hash belongs to the Windows user currently signed in to the device running Outlook, NOT necessarily the identity that received the malicious message. ↗
- ·Net-NTLMv2 hashes obtained via this exploit CANNOT be used in Pass-the-Hash attacks; they can only be used for NTLM relay attacks or offline dictionary/brute-force cracking. ↗
- ·Even on a patched Outlook client, UNC paths pointing to intranet/trusted zones can still trigger SMB or WebDAV credential leaks locally; the Exchange-side hotfix (stripping extended MAPI properties) is the more reliable mitigation. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
cisa9.8CRITICAL
vendor_msrc9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Microsoft Exchange Server Elevation of Privilege Vulnerability
vendor_msrc·2024-02-13·CVSS 9.8
CVE-2024-21410 [CRITICAL] CWE-287 Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
FAQ: Where can I find more information about NTLM relay attacks?
Download Mitigating Pass the Hash (PtH) Attacks and Other Credential Theft, Version 1 and 2. This document discusses Pass-the-Hash (PtH) attacks against the Windows operating systems and provides holistic planning strategies that, when combined with the Windows security features, will provide a more effective defense against pass-the-hash attacks.
FAQ: How could an attacker exploit this vulnerability?
An attacker could target an NTLM client such as Outlook with an NTLM credentials-leaking type vulnerability. The leaked credentials can then be relayed against the Exchange server to gain privileges as the victim client and to perform operations on the Exchange ser
Microsoft
Windows MSHTML Platform Security Feature Bypass Vulnerability
vendor_msrc·2023-05-09·CVSS 6.5
CVE-2023-29324 [CRITICAL] CWE-73 Windows MSHTML Platform Security Feature Bypass Vulnerability
Windows MSHTML Platform Security Feature Bypass Vulnerability
FAQ: According to the CVSS metric, successful exploitation of this vulnerability could lead to some loss of integrity (I:L) and some loss of availability (A:L). What does that mean for this vulnerability?
An attacker who successfully exploits the vulnerability could craft a malicious URL that would evade zone checks, resulting in a limited loss of integrity and availability on the victim machine.
FAQ: Are there additional steps that I need to take to be protected from this vulnerability?
Yes. Customers must install the updates for CVE-2023-23397 and CVE-2023-29324 to be fully protected. For more information, please see the MSRC Blog Post relating to CVE-2023-23397 here: Microsoft Mitigates Outlook Elevation of Privilege Vulner
Microsoft
Microsoft Outlook Elevation of Privilege Vulnerability
vendor_msrc·2023-03-14·CVSS 9.8
CVE-2023-23397 [CRITICAL] CWE-20 Microsoft Outlook Elevation of Privilege Vulnerability
Microsoft Outlook Elevation of Privilege Vulnerability
FAQ: According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H), integrity (I:H) and availability (A:H). What does that mean for this vulnerability?
An attacker who successfully exploited this vulnerability could access a user's Net-NTLMv2 hash which could be used as a basis of an NTLM Relay attack against another service to authenticate as the user.
FAQ: Is the Preview Pane an attack vector for this vulnerability?
The attacker could exploit this vulnerability by sending a specially crafted email which triggers automatically when it is retrieved and processed by the Outlook client. This could lead to exploitation BEFORE the email is viewed in the Preview Pane.
FAQ:
CISA
Microsoft Office Outlook Privilege Escalation Vulnerability
cisa·2023-03-14·CVSS 9.8
CVE-2023-23397 [CRITICAL] CWE-294 Microsoft Office Outlook Privilege Escalation Vulnerability
Vulnerability: Microsoft Office Outlook Privilege Escalation Vulnerability
Affected: Microsoft Office
Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user.
Required Action: Apply updates per vendor instructions.
Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-23397, https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/, ; https://nvd.nist.gov/vuln/detail/CVE-2023-23397
Remediation Due Date: 2023-04-04
GHSA
GHSA-4778-q233-jmh5: Microsoft Outlook Elevation of Privilege Vulnerability
ghsa_unreviewed·2023-03-14
CVE-2023-23397 [CRITICAL] CWE-20 GHSA-4778-q233-jmh5: Microsoft Outlook Elevation of Privilege Vulnerability
Microsoft Outlook Elevation of Privilege Vulnerability
VulnCheck
Microsoft Office Outlook Privilege Escalation Vulnerability
vulncheck·2023·CVSS 9.8
CVE-2023-23397 [CRITICAL] CWE-294 Microsoft Office Outlook Privilege Escalation Vulnerability
Microsoft Office Outlook Privilege Escalation Vulnerability
Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user.
Affected: Microsoft Office
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2023-Mar; https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit; https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.deepinstinct.com/blog/cve-2023-23397-exploitations-in-the-wild-what-you-need-to-
VulnCheck
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
vulncheck·2022·CVSS 7.8
CVE-2022-30190 [HIGH] CWE-610 Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.
Affected: Microsoft Windows
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2022-May; https://cisa.gov/news-events/alerts/2022/05/31/microsoft-releases-workaround-guidance-msdt-follina-vulnerability; https://www.malwarebytes.com/blog/threat-intelligence/2022/06/russias-apt28-uses-fear-of-nuclear-war-to-spread-follina-docs-in-ukraine; https://doc
Suricata
ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M3 (CVE-2023-23397)
suricata·2023-03-16·CVSS 9.8
CVE-2023-23397 [CRITICAL] ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M3 (CVE-2023-23397)
ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M3 (CVE-2023-23397)
Rule: alert smtp any any -> [$HOME_NET,$SMTP_SERVERS] any (msg:"ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M3 (CVE-2023-23397)"; content:"AElQTS5UYXNr"; fast_pattern; content:"|0d 0a 0d 0a|"; base64_decode:offset 0,relative; base64_data; content:"|78 9f 3e 22|"; startswith; content:"|00|IPM.Task"; content:"|5c|"; pcre:"/^\x00?\\\x00?[\w\.\-\x00]+\\/R"; reference:url,msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397; reference:cve,2023-23397; classtype:attempted-admin; sid:2044682; rev:3; metadata:created_at 2023_03_16, cve CVE_2023_23397, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, upda
Suricata
ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M4 (CVE-2023-23397)
suricata·2023-03-16·CVSS 9.8
CVE-2023-23397 [CRITICAL] ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M4 (CVE-2023-23397)
ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M4 (CVE-2023-23397)
Rule: alert smtp any any -> [$HOME_NET,$SMTP_SERVERS] any (msg:"ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M4 (CVE-2023-23397)"; content:"SQBQAE0ALgBNAGkAYwByAG8AcwBvAGYAdAAgAE0AYQBpAGwALgBOAG8AdABlA"; fast_pattern; content:"|0d 0a 0d 0a|"; base64_decode:offset 0,relative; base64_data; content:"|78 9f 3e 22|"; startswith; content:"I|00|P|00|M|00|.|00|M|00|i|00|c|00|r|00|o|00|s|00|o|00|f|00|t|00 20 00|M|00|a|00|i|00|l|00|.|00|N|00|o|00|t|00|e"; content:"|5c|"; pcre:"/^\x00?\\\x00?[\w\.\-\x00]+\\/R"; reference:url,msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397; reference:cve,2023-23397; classtype:attempted-admin; sid:2044683; rev:3; metadata:crea
Suricata
ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M1 (CVE-2023-23397)
suricata·2023-03-16·CVSS 9.8
CVE-2023-23397 [CRITICAL] ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M1 (CVE-2023-23397)
ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M1 (CVE-2023-23397)
Rule: alert smtp any any -> [$HOME_NET,$SMTP_SERVERS] any (msg:"ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M1 (CVE-2023-23397)"; content:"AElQTS5UYXNr"; fast_pattern; content:"|0d 0a 0d 0a|"; base64_decode:offset 0,relative; base64_data; content:"|78 9f 3e 22|"; startswith; content:"I|00|P|00|M|00|.|00|T|00|a|00|s|00|k"; content:"|5c|"; pcre:"/^\x00?\\\x00?[\w\.\-\x00]+\\/R"; reference:url,msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397; reference:cve,2023-23397; classtype:attempted-admin; sid:2044680; rev:3; metadata:created_at 2023_03_16, cve CVE_2023_23397, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Generated_B
Suricata
ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M5 (CVE-2023-23397)
suricata·2023-03-16·CVSS 9.8
CVE-2023-23397 [CRITICAL] ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M5 (CVE-2023-23397)
ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M5 (CVE-2023-23397)
Rule: alert smtp $SMTP_SERVERS any -> any any (msg:"ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M5 (CVE-2023-23397)"; content:"AElQTS5UYXNr"; fast_pattern; content:"|0d 0a 0d 0a|"; base64_decode:offset 0,relative; base64_data; content:"|78 9f 3e 22|"; startswith; content:"|00|IPM.Task"; content:"|5c|"; pcre:"/^\x00?\\\x00?[\w\.\-\x00]+\\/R"; reference:url,msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397; reference:cve,2023-23397; classtype:attempted-admin; sid:2044684; rev:3; metadata:created_at 2023_03_16, cve CVE_2023_23397, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_
Suricata
ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M8 (CVE-2023-23397)
suricata·2023-03-16·CVSS 9.8
CVE-2023-23397 [CRITICAL] ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M8 (CVE-2023-23397)
ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M8 (CVE-2023-23397)
Rule: alert smtp $SMTP_SERVERS any -> any any (msg:"ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M8 (CVE-2023-23397)"; content:"SVBNLk1pY3Jvc29mdCBNYWlsLk5vdG"; fast_pattern; content:"|0d 0a 0d 0a|"; base64_decode:offset 0,relative; base64_data; content:"|78 9f 3e 22|"; startswith; content:"IPM.Microsoft|20|Mail.Note"; content:"|5c|"; pcre:"/^\x00?\\\x00?[\w\.\-\x00]+\\/R"; reference:url,msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397; reference:cve,2023-23397; classtype:attempted-admin; sid:2044687; rev:3; metadata:created_at 2023_03_16, cve CVE_2023_23397, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Pr
Suricata
ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M6 (CVE-2023-23397)
suricata·2023-03-16·CVSS 9.8
CVE-2023-23397 [CRITICAL] ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M6 (CVE-2023-23397)
ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M6 (CVE-2023-23397)
Rule: alert smtp $SMTP_SERVERS any -> any any (msg:"ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M6 (CVE-2023-23397)"; content:"SQBQAE0ALgBUAGEAcwBrA"; fast_pattern; content:"|0d 0a 0d 0a|"; base64_decode:offset 0,relative; base64_data; content:"|78 9f 3e 22|"; startswith; content:"|00|I|00|P|00|M|00|.|00|T|00|a|00|s|00|k"; content:"|5c|"; pcre:"/^\x00?\\\x00?[\w\.\-\x00]+\\/R"; reference:url,msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397; reference:cve,2023-23397; classtype:attempted-admin; sid:2044685; rev:3; metadata:created_at 2023_03_16, cve CVE_2023_23397, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Generated_
Suricata
ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M2 (CVE-2023-23397)
suricata·2023-03-16·CVSS 9.8
CVE-2023-23397 [CRITICAL] ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M2 (CVE-2023-23397)
ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M2 (CVE-2023-23397)
Rule: alert smtp any any -> [$HOME_NET,$SMTP_SERVERS] any (msg:"ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M2 (CVE-2023-23397)"; content:"SVBNLk1pY3Jvc29mdCBNYWlsLk5vdG"; fast_pattern; content:"|0d 0a 0d 0a|"; base64_decode:offset 0,relative; base64_data; content:"|78 9f 3e 22|"; startswith; content:"IPM.Microsoft|20|Mail.Note"; content:"|5c|"; pcre:"/^\x00?\\\x00?[\w\.\-\x00]+\\/R"; reference:url,msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397; reference:cve,2023-23397; classtype:attempted-admin; sid:2044681; rev:3; metadata:created_at 2023_03_16, cve CVE_2023_23397, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Gen
Suricata
ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M7 (CVE-2023-23397)
suricata·2023-03-16·CVSS 9.8
CVE-2023-23397 [CRITICAL] ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M7 (CVE-2023-23397)
ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M7 (CVE-2023-23397)
Rule: alert smtp $SMTP_SERVERS any -> any any (msg:"ET EXPLOIT Possible Microsoft Outlook Elevation of Privilege Payload Observed M7 (CVE-2023-23397)"; content:"SQBQAE0ALgBNAGkAYwByAG8AcwBvAGYAdAAgAE0AYQBpAGwALgBOAG8AdABlA"; fast_pattern; content:"|0d 0a 0d 0a|"; base64_decode:offset 0,relative; base64_data; content:"|78 9f 3e 22|"; startswith; content:"I|00|P|00|M|00|.|00|M|00|i|00|c|00|r|00|o|00|s|00|o|00|f|00|t|00 20 00|M|00|a|00|i|00|l|00|.|00|N|00|o|00|t|00|e"; content:"|5c|"; pcre:"/^\x00?\\\x00?[\w\.\-\x00]+\\/R"; reference:url,msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397; reference:cve,2023-23397; classtype:attempted-admin; sid:2044686; rev:3; metadata:created_at 2023_
Sigma
Suspicious WebDav Client Execution Via Rundll32.EXE
sigma·CVSS 9.8
CVE-2023-23397 [CRITICAL] Suspicious WebDav Client Execution Via Rundll32.EXE
Suspicious WebDav Client Execution Via Rundll32.EXE
Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server) or potentially a sign of exploitation of CVE-2023-23397
Detection:
condition: selection and not 1 of filter_*
filter_local_ips:
CommandLine|contains:
- ://10.
- ://192.168.
- ://172.16.
- ://172.17.
- ://172.18.
- ://172.19.
- ://172.20.
- ://172.21.
- ://172.22.
- ://172.23.
- ://172.24.
- ://172.25.
- ://172.26.
- ://172.27.
- ://172.28.
- ://172.29.
- ://172.30.
- ://172.31.
- ://127.
- ://169.254.
selection:
CommandLine|contains: C:\windows\system32\davclnt.dll,DavSetCookie
CommandLine|re: ://\d{1,3}\.\d{1,3}\.\d{1
No public exploits indexed.
Tenable
Inside the customer environment: Where threat actors, vulnerabilities, and exposed assets intersect
blogs_tenable·2026-05-27
CVE-2023-4966 Inside the customer environment: Where threat actors, vulnerabilities, and exposed assets intersect
## Exposure Management
## Explore By Use Case
## Explore By Industry
## Tenable is the one clear leader in Exposure Management
## Exposure management
resource center
## Accelerate your exposure management strategy with practical resources and tools.
## Explore By Use Case
## Explore By Industry
## Tenable is the one clear leader in Exposure Management
## Exposure management
resource center
## Accelerate your exposure management strategy with practical resources and tools.
## Inside the customer environment: Where threat actors, vulnerabilities, and exposed assets intersect
Tenable Research has developed a graph-based model linking 600+ threat groups to real-world customer exposures. It reveals which vulnerabilities sit at the intersection of severity, active exploit
Hackernews
⚡ Weekly Recap: Fiber Optic Spying, Windows Rootkit, AI Vulnerability Hunting and More
blogs_hackernews·2026-04-13·CVSS 8.6
[HIGH] ⚡ Weekly Recap: Fiber Optic Spying, Windows Rootkit, AI Vulnerability Hunting and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Fiber Optic Spying, Windows Rootkit, AI Vulnerability Hunting and More
Monday is back, and the weekend’s backlog of chaos is officially hitting the fan. We are tracking a critical zero-day that has been quietly living in your PDFs for months, plus some aggressive state-sponsored meddling in infrastructure that is finally coming to light. It is one of those mornings where the gap between a quiet shift and a full-blown incident response is basically non-existent.
The variety this week is particularly nasty. We have AI models being turned into autonomous exploit engines, North Korean groups playing the long game
Bleepingcomputer
Russian hackers breach orgs to track aid routes to Ukraine
blogs_bleepingcomputer·2025-05-21·CVSS 9.8
[CRITICAL] Russian hackers breach orgs to track aid routes to Ukraine
## Russian hackers breach orgs to track aid routes to Ukraine
## Ionut Ilascu
A Russian state-sponsored cyberespionage campaign attributed to APT28 (Fancy Bear/Forest Blizzard) hackers has been targeting and compromising international organizations since 2022 to disrupt aid efforts to Ukraine.
The hackers targeted entities in the defense, transportation, IT services, air traffic, and maritime sectors in 12 European countries and the United States.
Additionally, the hackers have been tracking the movement of materials into Ukraine by compromising access to private cameras installed in key locations (e.g. border crossings, military installations, rail stations).
A joint advisory from 21 intelligence and cybersecurity agencies in nearly a dozen countries shares the tactics, techniques, a
Bleepingcomputer
ThreatLocker Patch Management: A Security-First Approach to Closing Vulnerability Windows
blogs_bleepingcomputer·2025-05-21·CVSS 9.1
[CRITICAL] ThreatLocker Patch Management: A Security-First Approach to Closing Vulnerability Windows
## ThreatLocker Patch Management: A Security-First Approach to Closing Vulnerability Windows
## ThreatLocker
Patching vulnerabilities is one of the most basic principles of cybersecurity — and one of the hardest to execute consistently and securely at scale.
In today’s threat landscape, adversaries routinely exploit vulnerabilities within hours of public disclosure. Yet, operational constraints, patch instability, and incomplete visibility into assets make it almost impossible for many organizations to patch fast enough without introducing new risks.
ThreatLocker Patch Management is built to tackle this reality head-on, providing security teams with greater control, visibility, and confidence over patching workflows — without compromising the stability of production systems.
## Why Tr
Wiz
What Is Privilege Escalation? Types and Prevention Strategies | Wiz
blogs_wiz·2025-03-18
What Is Privilege Escalation? Types and Prevention Strategies | Wiz
Privilege escalation is when an attacker exploits weaknesses in your environment or infrastructure to gain higher access and control within a system or network.
Most organizations take multiple measures to tighten security, including defining different privilege levels for different user accounts. For example, you wouldn’t give ordinary users access to your most confidential, business-critical files. These security measures frustrate attackers who access your system through lower-privileged user accounts—so they try to gain more privileges in order to achieve malicious goals such as exfiltrating or encrypting your data.
## Incident Response Playbook Template: Privilege Escalation in EKS
Detect, investigate, and respond to privilege escalation in Amazon EKS clusters with this comprehensi
Wiz
What Is Privilege Escalation? Types and Prevention Strategies | Wiz
blogs_wiz·2025-03-18
What Is Privilege Escalation? Types and Prevention Strategies | Wiz
Privilege escalation is when an attacker exploits weaknesses in your environment or infrastructure to gain higher access and control within a system or network.
Most organizations take multiple measures to tighten security, including defining different privilege levels for different user accounts. For example, you wouldn’t give ordinary users access to your most confidential, business-critical files. These security measures frustrate attackers who access your system through lower-privileged user accounts—so they try to gain more privileges in order to achieve malicious goals such as exfiltrating or encrypting your data.
Incident Response Playbook Template: Privilege Escalation in EKSDetect, investigate, and respond to privilege escalation in Amazon EKS clusters with this comprehensive in
Greynoiseio
GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs
blogs_greynoiseio·2025-02-26·CVSS 9.8
[CRITICAL] GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Qualys
Defense Lessons From the Black Basta Ransomware Playbook
blogs_qualys·2025-02-25
Defense Lessons From the Black Basta Ransomware Playbook
## Table of Contents
Know Your Enemys Playbook
Attackers Move Fast
How Qualys Can Help
The cybersecurity world was rocked last week by a massive leak of Black Basta’s internal communications that emerged from the group’s chat logs. Triggered by internal conflicts and a retaliatory data dump following attacks on Russian banks, the exposed records offer a rare glimpse into Black Basta’s tactics, operations, and leadership.
We’ve analyzed these newly unveiled tactics, and in this blog, we equip security teams with clear, actionable insights. We aim to highlight the key lessons learned—like immediate patching, tighter access controls, and rapid incident response—and provide an urgent call to action. This practical guide aims to help organizations strengthen their defenses against evolving
Qualys
Defense Lessons From the Black Basta Ransomware Playbook | Qualys
blogs_qualys·2025-02-25
Defense Lessons From the Black Basta Ransomware Playbook | Qualys
#### Table of Contents
- Know Your Enemys Playbook
- Attackers Move Fast
- How Qualys Can Help
The cybersecurity world was rocked last week by a massive leak of Black Basta’s internal communications that emerged from the group’s chat logs. Triggered by internal conflicts and a retaliatory data dump following attacks on Russian banks, the exposed records offer a rare glimpse into Black Basta’s tactics, operations, and leadership.
We’ve analyzed these newly unveiled tactics, and in this blog, we equip security teams with clear, actionable insights. We aim to highlight the key lessons learned—like immediate patching, tighter access controls, and rapid incident response—and provide an urgent call to action. This practical guide aims to help organizations strengthen their defenses against ev
Bleepingcomputer
BadPilot network hacking campaign fuels Russian SandWorm attacks
blogs_bleepingcomputer·2025-02-12
BadPilot network hacking campaign fuels Russian SandWorm attacks
## BadPilot network hacking campaign fuels Russian SandWorm attacks
## Bill Toulas
A subgroup of the Russian state-sponsored hacking group APT44, also known as 'Seashell Blizzard' and 'Sandworm', has been targeting critical organizations and governments in a multi-year campaign dubbed 'BadPilot.'
The threat actor has been active since at least 2021 and is also responsible for breaching networks of organizations in energy, oil and gas, telecommunications, shipping, and arms manufacturing sectors.
Microsoft's Threat Intelligence team says that the actor is dedicated to achieving initial access to target systems, establishing persistence, and maintaining presence to allow other APT44 subgroups with post-compromise expertise to take over.
"We have also observed the initial access subgroup
Securelist
Exploits and vulnerabilities in Q3 2024
blogs_securelist·2024-12-06·CVSS 8.1
CVE-2024-47177 [HIGH] Exploits and vulnerabilities in Q3 2024
Table of Contents
Statistics on registered vulnerabilities
Exploitation statistics
Windows and Linux vulnerability exploitation
Most prevalent exploits
Vulnerability exploitation in APT attacks
Interesting vulnerabilities
CVE-2024-47177 (CUPS filters)
CVE-2024-38112 (MSHTML Spoofing)
CVE-2024-6387 (regreSSHion)
CVE-2024-3183 (Free IPA)
CVE-2024-45519 (Zimbra)
CVE-2024-5290 (Ubuntu wpa_supplicant)
Conclusion and advice
Authors
Alexander Kolesnikov
Q3 2024 saw multiple vulnerabilities discovered in Windows and Linux subsystems that are not standard for cyberattacks. This is because operating system developers have been releasing new security mitigations for whole sets of vulnerabilities in commonly used subsystems. For example, a log integrity check is set to appear in the Co
Securelist
Analyzing the vulnerability landscape in Q3 2024
blogs_securelist·2024-12-06·CVSS 8.1
CVE-2024-47177 [HIGH] Analyzing the vulnerability landscape in Q3 2024
Table of Contents
- Statistics on registered vulnerabilities
- Exploitation statistics
- Vulnerability exploitation in APT attacks
- Interesting vulnerabilities
- CVE-2024-47177 (CUPS filters)
- CVE-2024-38112 (MSHTML Spoofing)
- CVE-2024-6387 (regreSSHion)
- CVE-2024-3183 (Free IPA)
- CVE-2024-45519 (Zimbra)
- CVE-2024-5290 (Ubuntu wpa_supplicant)
- Conclusion and advice
Authors
- Alexander Kolesnikov
Q3 2024 saw multiple vulnerabilities discovered in Windows and Linux subsystems that are not standard for cyberattacks. This is because operating system developers have been releasing new security mitigations for whole sets of vulnerabilities in commonly used subsystems. For example, a log integrity check is set to appear in the Common Log Filing System (CLFS) in Windows, so the number
Bleepingcomputer
FBI, CISA, and NSA reveal most exploited vulnerabilities of 2023
blogs_bleepingcomputer·2024-11-12·CVSS 10.0
[CRITICAL] FBI, CISA, and NSA reveal most exploited vulnerabilities of 2023
## FBI, CISA, and NSA reveal most exploited vulnerabilities of 2023
## Sergiu Gatlan
The FBI, the NSA, and Five Eyes cybersecurity authorities have released a list of the top 15 routinely exploited vulnerabilities throughout last year, most of them first abused as zero-days.
A joint advisory published on Tuesday calls for organizations worldwide to immediately patch these security flaws and deploy patch management systems to minimize their networks' exposure to potential attacks.
"In 2023, malicious cyber actors exploited more zero-day vulnerabilities to compromise enterprise networks compared to 2022, allowing them to conduct cyber operations against higher-priority targets," the cybersecurity agencies warned .
"In 2023, the majority of the most frequently exploited vulnerabilities
Krebs
Microsoft Patch Tuesday, July 2024 Edition
blogs_krebs·2024-07-09·CVSS 9.8
CVE-2024-38080 [CRITICAL] Microsoft Patch Tuesday, July 2024 Edition
Microsoft Corp. today issued software updates to plug at least 139 security holes in various flavors of Windows and other Microsoft products. Redmond says attackers are already exploiting at least two of the vulnerabilities in active attacks against Windows users.
The first Microsoft zero-day this month is CVE-2024-38080 , a bug in the Windows Hyper-V component that affects Windows 11 and Windows Server 2022 systems. CVE-2024-38080 allows an attacker to increase their account privileges on a Windows machine. Although Microsoft says this flaw is being exploited, it has offered scant details about its exploitation.
The other zero-day is CVE-2024-38112 , which is a weakness in MSHTML , the proprietary engine of Microsoft’s Internet Explorer web browser. Kevin Breen , senior director of thre
Krebs
Microsoft Patch Tuesday, July 2024 Edition
blogs_krebs·2024-07-09·CVSS 9.8
CVE-2024-38080 [CRITICAL] Microsoft Patch Tuesday, July 2024 Edition
Microsoft Corp. today issued software updates to plug at least 139 security holes in various flavors of Windows and other Microsoft products. Redmond says attackers are already exploiting at least two of the vulnerabilities in active attacks against Windows users.
The first Microsoft zero-day this month is CVE-2024-38080, a bug in the Windows Hyper-V component that affects Windows 11 and Windows Server 2022 systems. CVE-2024-38080 allows an attacker to increase their account privileges on a Windows machine. Although Microsoft says this flaw is being exploited, it has offered scant details about its exploitation.
The other zero-day is CVE-2024-38112, which is a weakness in MSHTML, the proprietary engine of Microsoft’s Internet Explorer web browser. Kevin Breen, senior director of threat r
Bleepingcomputer
Poland says Russian military hackers target its govt networks
blogs_bleepingcomputer·2024-05-09
Poland says Russian military hackers target its govt networks
## Poland says Russian military hackers target its govt networks
## Sergiu Gatlan
Once clicked, the link redirected them through multiple websites before landing on a page that downloaded a ZIP archive. The archive contained a malicious executable disguised as a JPG image file and two hidden files: a DLL and a .BAT script.
If the target opens the camouflaged executable file, it loads the DLL via DLL side loading, which runs the hidden script. The script displays a photo of a woman in a swimsuit in the Microsoft Edge browser as a distraction while simultaneously downloading a CMD file and changing its extension to JPG.
"The script we finally received collects only information about the computer (IP address and list of files in selected folders) on which they were launched, and then send
Wiz
Crying Out Cloud - May 2024 Newsletter | Wiz
blogs_wiz·2024-05-06·CVSS 10.0
[CRITICAL] Crying Out Cloud - May 2024 Newsletter | Wiz
Welcome back! In this edition, we bring you the latest in cloud security – noteworthy incidents, exclusive data, and crucial vulnerabilities. Let's dive in.
Here are our top picks of cloud security highlights!
## 🔎 Highlights
Architecture Risks that May Compromise AI-as-a-Service Providers
Wiz research recently performed a security audit of Hugging Face and discovered several security issues that would have allowed an actor running a specially-crafted malicious model on Hugging Face's infrastructure to achieve remote code execution and cross-tenant access to other customers' spaces or models. All these issues were remediated by Hugging Face and no customer action is required.
Learn more in our blog .
## 🐞 High Profile Vulnerabilities
DoS Vulnerability in HTTP/2 CONTINUATION Frames
Krebs
Fat Patch Tuesday, February 2024 Edition
blogs_krebs·2024-02-13·CVSS 5.4
CVE-2024-21412 [MEDIUM] Fat Patch Tuesday, February 2024 Edition
Microsoft Corp. today pushed software updates to plug more than 70 security holes in its Windows operating systems and related products, including two zero-day vulnerabilities that are already being exploited in active attacks.
Top of the heap on this Fat Patch Tuesday is CVE-2024-21412, a “security feature bypass” in the way Windows handles Internet Shortcut Files that Microsoft says is being targeted in active exploits. Redmond’s advisory for this bug says an attacker would need to convince or trick a user into opening a malicious shortcut file.
Researchers at Trend Micro have tied the ongoing exploitation of CVE-2024-21412 to an advanced persistent threat group dubbed “Water Hydra,” which they say has being using the vulnerability to execute a malicious Microsoft Installer File (.msi)
Krebs
Fat Patch Tuesday, February 2024 Edition
blogs_krebs·2024-02-13·CVSS 5.4
CVE-2024-21412 [MEDIUM] Fat Patch Tuesday, February 2024 Edition
Microsoft Corp. today pushed software updates to plug more than 70 security holes in its Windows operating systems and related products, including two zero-day vulnerabilities that are already being exploited in active attacks.
Top of the heap on this Fat Patch Tuesday is CVE-2024-21412 , a “security feature bypass” in the way Windows handles Internet Shortcut Files that Microsoft says is being targeted in active exploits. Redmond’s advisory for this bug says an attacker would need to convince or trick a user into opening a malicious shortcut file.
Researchers at Trend Micro have tied the ongoing exploitation of CVE-2024-21412 to an advanced persistent threat group dubbed “ Water Hydra ,” which they say has being using the vulnerability to execute a malicious Microsoft Installer File (.m
Trendmicro
Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
blogs_trendmicro·2024-01-31
Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
APT & Targeted Attacks
## Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
To help defenders learn more about Pawn Storm's activities and adjust their defences, we offer a technical analysis of some of the threat actor's recent and updated techniques.
By: Feike Hacquebord, Fernando Merces Jan 31, 2024 Read time: ( words)
Save to Folio
Armed forces
Europe, South America
Central bank
Middle East
City council
Asia, Europe, Middle East, North America, Africa
Defence industry
Europe , North America, South America
Aerospace industry
Europe
Electricity authority
Europe, Middle East
Energy sector
Europe
Intellectual property authority
Middle East
Ministry of Agriculture
Europe, South America
Ministry of Energy
Europe
Ministry of Environment
Europe
Minis
Trendmicro
Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
blogs_trendmicro·2024-01-31
Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
APT & Targeted Attacks
## Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
To help defenders learn more about Pawn Storm's activities and adjust their defenses, we offer a technical analysis of some of the threat actor's recent and updated techniques.
By: Feike Hacquebord, Fernando Merces Jan 31, 2024 Read time: ( words)
Save to Folio
Armed forces
Europe, South America
Central bank
Middle East
City council
Asia, Europe, Middle East, North America, Africa
Defense industry
Europe , North America, South America
Aerospace industry
Europe
Electricity authority
Europe, Middle East
Energy sector
Europe
Intellectual property authority
Middle East
Ministry of Agriculture
Europe, South America
Ministry of Energy
Europe
Ministry of Environment
Europe
Minis
Trendmicro
Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
blogs_trendmicro·2024-01-31
Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
APT & Targeted Attacks
# Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
To help defenders learn more about Pawn Storm's activities and adjust their defenses, we offer a technical analysis of some of the threat actor's recent and updated techniques.
By: Feike Hacquebord, Fernando Merces
2024/01/31
Read time: ( words)
Save to Folio
Introduction
Pawn Storm (also known as APT28 and Forest Blizzard) is an advanced persistent threat (APT) actor that shows incessant and lasting repetitions in its tactics, techniques, and procedures (TTPs). Some of the group’s campaigns involve using the same kind of technical tricks repeatedly, sometimes targeting hundreds of people in a single organization at the same time.
The threat actor is known for still using its phishing email
Trendmicro
Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
blogs_trendmicro·2024-01-31
Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
APT y ataques dirigidos
## Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
To help defenders learn more about Pawn Storm's activities and adjust their defenses, we offer a technical analysis of some of the threat actor's recent and updated techniques.
By: Feike Hacquebord, Fernando Merces Jan 31, 2024 Read time: ( words)
Save to Folio
Armed forces
Europe, South America
Central bank
Middle East
City council
Asia, Europe, Middle East, North America, Africa
Defense industry
Europe , North America, South America
Aerospace industry
Europe
Electricity authority
Europe, Middle East
Energy sector
Europe
Intellectual property authority
Middle East
Ministry of Agriculture
Europe, South America
Ministry of Energy
Europe
Ministry of Environment
Europe
Mini
Trendmicro
Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
blogs_trendmicro·2024-01-31
Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
APT & Targeted Attacks
## Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
To help defenders learn more about Pawn Storm's activities and adjust their defenses, we offer a technical analysis of some of the threat actor's recent and updated techniques.
By: Feike Hacquebord, Fernando Merces 2024/01/31 Read time: ( words)
Save to Folio
Armed forces
Europe, South America
Central bank
Middle East
City council
Asia, Europe, Middle East, North America, Africa
Defense industry
Europe , North America, South America
Aerospace industry
Europe
Electricity authority
Europe, Middle East
Energy sector
Europe
Intellectual property authority
Middle East
Ministry of Agriculture
Europe, South America
Ministry of Energy
Europe
Ministry of Environment
Europe
Ministr
Qualys
2023 Threat Landscape Year in Review: If Everything Is Critical, Nothing Is
blogs_qualys·2023-12-19
2023 Threat Landscape Year in Review: If Everything Is Critical, Nothing Is
## Table of Contents
2023 Statistics
2023 Vulnerability Threat Landscape
Top Vulnerability Types
Key Insights
Top MITRE ATT&CK Tactics & Techniques
Most Active Threats
Conclusion
As 2023 nears its end, it’s time to pause and reflect. It’s time to assess what worked and what didn’t, what caught our attention and caused disruption, and what went unnoticed. More importantly, we need to know what lessons we learned from 2023 so that we can do a better job of managing risk in the coming year. In line with this, the Qualys Threat Research Unit has prepared a comprehensive blog series to review the threat landscape in 2023.
Key Takeaways:
Less than one percent of vulnerabilities contributed to the highest risk and were routinely exploited in the wild.
97 high-risk vulnerabilities, like
Qualys
Top Cyber Threats of 2023: An In-Depth Review (Part One) | Qualys
blogs_qualys·2023-12-19
Top Cyber Threats of 2023: An In-Depth Review (Part One) | Qualys
#### Table of Contents
- 2023 Statistics
- 2023 Vulnerability Threat Landscape
- Top Vulnerability Types
- Key Insights
- Top MITRE ATT&CK Tactics & Techniques
- Most Active Threats
- Conclusion
As 2023 nears its end, it’s time to pause and reflect. It’s time to assess what worked and what didn’t, what caught our attention and caused disruption, and what went unnoticed. More importantly, we need to know what lessons we learned from 2023 so that we can do a better job of managing risk in the coming year. In line with this, the Qualys Threat Research Unit has prepared a comprehensive blog series to review the threat landscape in 2023.
Key Takeaways:
- Less than one percent of vulnerabilities contributed to the highest risk and were routinely exploited in the wild.
- 97 high-risk vulnerab
Krebs
Microsoft Patch Tuesday, December 2023 Edition
blogs_krebs·2023-12-13·CVSS 8.1
[HIGH] Microsoft Patch Tuesday, December 2023 Edition
The final Patch Tuesday of 2023 is upon us, with Microsoft Corp. today releasing fixes for a relatively small number of security holes in its Windows operating systems and other software. Even more unusual, there are no known “zero-day” threats targeting any of the vulnerabilities in December’s patch batch. Still, four of the updates pushed out today address “critical” vulnerabilities that Microsoft says can be exploited by malware or malcontents to seize complete control over a vulnerable Windows device with little or no help from users.
Among the critical bugs quashed this month is CVE-2023-35628, a weakness present in Windows 10 and later versions, as well as Microsoft Server 2008 and later. Kevin Breen, senior director of threat research at Immersive Labs, said the flaw affects MSHTML
Krebs
Microsoft Patch Tuesday, December 2023 Edition
blogs_krebs·2023-12-12·CVSS 8.1
[HIGH] Microsoft Patch Tuesday, December 2023 Edition
The final Patch Tuesday of 2023 is upon us, with Microsoft Corp. today releasing fixes for a relatively small number of security holes in its Windows operating systems and other software. Even more unusual, there are no known “zero-day” threats targeting any of the vulnerabilities in December’s patch batch. Still, four of the updates pushed out today address “critical” vulnerabilities that Microsoft says can be exploited by malware or malcontents to seize complete control over a vulnerable Windows device with little or no help from users.
Among the critical bugs quashed this month is CVE-2023-35628 , a weakness present in Windows 10 and later versions, as well as Microsoft Server 2008 and later. Kevin Breen , senior director of threat research at Immersive Labs , said the flaw affects MSH
Tenable
Microsoft Patch Tuesday 2023 Year in Review
blogs_tenable·2023-12-12
Microsoft Patch Tuesday 2023 Year in Review
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Unit42
Fighting Ursa Aka APT28: Illuminating a Covert Campaign
blogs_unit42·2023-12-07·CVSS 9.8
CVE-2023-23397 [CRITICAL] Fighting Ursa Aka APT28: Illuminating a Covert Campaign
Threat Research Center
Threat Actor Groups
Vulnerabilities
## Fighting Ursa Aka APT28: Illuminating a Covert Campaign
Unit 42
Published: December 7, 2023
Nation-State Cyberattacks
Threat Actor Groups
Vulnerabilities
Advanced Persistent Threat
APT28
Cortex XDR
CVE-2023-23397
Fancy Bear
Fighting Ursa
Microsoft Outlook
Microsoft Vulnerability
Privilege escalation
Russia
UAC-0001
Ukraine
## Executive Summary
Early this year, Ukrainian cybersecurity researchers found Fighting Ursa leveraging a zero-day exploit in Microsoft Outlook (now known as CVE-2023-23397). This vulnerability is especially concerning since it doesn’t require user interaction to exploit. Unit 42 researchers have observed this group using CVE-2023-23397 over the past 20 months to target at least 30 o
Bleepingcomputer
Russian military hackers target NATO fast reaction corps
blogs_bleepingcomputer·2023-12-07·CVSS 9.8
CVE-2023-23397 [CRITICAL] Russian military hackers target NATO fast reaction corps
## Russian military hackers target NATO fast reaction corps
## Sergiu Gatlan
Russian APT28 military hackers used Microsoft Outlook zero-day exploits to target multiple European NATO member countries, including a NATO Rapid Deployable Corps.
Researchers from Palo Alto Networks' Unit 42 have observed them exploiting the CVE-2023-23397 vulnerability over roughly 20 months in three campaigns against at least 30 organizations across 14 nations deemed of probable strategic intelligence significance to Russia's military and government.
The Russian hackers are also tracked as Fighting Ursa, Fancy Bear, and Sofacy, and they've been previously linked to Russia's Main Intelligence Directorate (GRU), the country's military intelligence service.
They started using the Outlook security flaw as a ze
Unit42
Fighting Ursa Aka APT28: Illuminating a Covert Campaign
blogs_unit42·2023-12-07·CVSS 9.8
CVE-2023-233397 [CRITICAL] Fighting Ursa Aka APT28: Illuminating a Covert Campaign
## Executive Summary
Early this year, Ukrainian cybersecurity researchers found Fighting Ursa leveraging a zero-day exploit in Microsoft Outlook (now known as CVE-2023-23397). This vulnerability is especially concerning since it doesn’t require user interaction to exploit. Unit 42 researchers have observed this group using CVE-2023-23397 over the past 20 months to target at least 30 organizations within 14 nations that are of likely strategic intelligence value to the Russian government and its military.
During this time, Fighting Ursa conducted at least two campaigns with this vulnerability that have been made public. The first occurred between March-December 2022 and the second occurred in March 2023.
Unit 42 researchers discovered a third, recently active campaign in which Fighting U
Checkpoint
The Obvious, the Normal, and the Advanced: A Comprehensive Analysis of Outlook Attack Vectors
blogs_checkpoint·2023-12-04
CVE-2023-21715 The Obvious, the Normal, and the Advanced: A Comprehensive Analysis of Outlook Attack Vectors
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 2
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 455
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 408
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 174
Web 3.0 Security 11
Wipers 0
## The Obvious, the Normal, and the Advanced: A Comprehensive Analysis of Outlook Attack Vectors
Research by: Haifei Li, Check Point Research
## Introduction
Outlook, the desktop app in t
Bleepingcomputer
Russian hackers exploiting Outlook bug to hijack Exchange accounts
blogs_bleepingcomputer·2023-12-04·CVSS 9.8
CVE-2023-23397 [CRITICAL] Russian hackers exploiting Outlook bug to hijack Exchange accounts
## Russian hackers exploiting Outlook bug to hijack Exchange accounts
## Bill Toulas
## Outlook flaw exploitation background
CVE-2023-23397 is a critical elevation of privilege (EoP) vulnerability in Outlook on Windows, which Microsoft fixed as a zero-day on the March 2023 Path Tuesday .
The disclosure of the flaw came with the revelation that APT28 had been exploiting it since April 2022 via specially crafted Outlook notes designed to steal NTLM hashes, forcing the target devices to authenticate to attacker-controlled SMB shares without requiring user interaction.
By elevating their privileges on the system, which was proven uncomplicated , APT28 performed lateral movement in the victim's environment and changed Outlook mailbox permissions to perform targeted email theft.
Despite th
Securelist
Kaspersky malware report for Q3 2023
blogs_securelist·2023-12-01·CVSS 9.8
[CRITICAL] Kaspersky malware report for Q3 2023
Table of Contents
- Targeted attacks
- Other malware
Authors
- David Emm
- IT threat evolution in Q3 2023
- IT threat evolution in Q3 2023. Non-mobile statistics
- IT threat evolution in Q3 2023. Mobile statistics
## Targeted attacks
### Unknown threat actor targets power generator with DroxiDat and Cobalt Strike
Earlier this year, we reported on a new variant of SystemBC called DroxiDat that was deployed against a critical infrastructure target in South Africa. This proxy-capable backdoor was deployed alongside Cobalt Strike beacons.
The incident occurred in the third and fourth week of March, as part of a small wave of attacks involving both DroxiDat and Cobalt Strike beacons around the world; and we believe this incident may have been the initial stage of a ransomware attack.
D
Securelist
IT threat evolution Q3 2023
blogs_securelist·2023-12-01·CVSS 9.8
CVE-2023-23397 [CRITICAL] IT threat evolution Q3 2023
Table of Contents
Targeted attacks
Unknown threat actor targets power generator with DroxiDat and Cobalt Strike
Analysis of samples exploiting CVE-2023-23397 vulnerability
Common TTPs in attacks on industrial organizations
Evil Telegram doppelganger used to target people in China
Other malware
Possible supply-chain attack on Linux machines
The Cuba ransomware gang
Leaked Lockbit 3 builder
The evolving world of crimeware
A cryptor, a stealer and a banking Trojan
Authors
David Emm
IT threat evolution in Q3 2023
IT threat evolution in Q3 2023. Non-mobile statistics
IT threat evolution in Q3 2023. Mobile statistics
## Targeted attacks
## Unknown threat actor targets power generator with DroxiDat and Cobalt Strike
Earlier this year, we reported on a new variant of SystemBC ca
Zscaler
Vulnerabilities in Microsoft 365 Apps | ThreatLabz
blogs_zscaler·2023-11-21·CVSS 7.8
[HIGH] Vulnerabilities in Microsoft 365 Apps | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Checkpoint
Abusing Microsoft Access “Linked Table” Feature to Perform NTLM Forced Authentication Attacks
blogs_checkpoint·2023-11-09
CVE-2023-23397 Abusing Microsoft Access “Linked Table” Feature to Perform NTLM Forced Authentication Attacks
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 2
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 455
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 408
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 174
Web 3.0 Security 11
Wipers 0
## Abusing Microsoft Access “Linked Table” Feature to Perform NTLM Forced Authentication Attacks
Microsoft Access (part of the Office suite) has a “linking to remote SQL Server tables” featur
Zscaler
Vulnerabilities in Microsoft 365 Apps | ThreatLabz
blogs_zscaler·2023-10-31·CVSS 7.8
[HIGH] Vulnerabilities in Microsoft 365 Apps | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Bleepingcomputer
France says Russian state hackers breached numerous critical networks
blogs_bleepingcomputer·2023-10-26·CVSS 9.8
CVE-2023-38831 [CRITICAL] France says Russian state hackers breached numerous critical networks
## France says Russian state hackers breached numerous critical networks
## Bill Toulas
The Russian APT28 hacking group (aka 'Strontium' or 'Fancy Bear') has been targeting government entities, businesses, universities, research institutes, and think tanks in France since the second half of 2021.
The threat group, which is considered part of Russia's military intelligence service GRU, was recently linked to the exploitation of CVE-2023-38831 , a remote code execution vulnerability in WinRAR, and CVE-2023-23397 , a zero-day privilege elevation flaw in Microsoft Outlook.
The Russian hackers have been compromising peripheral devices on critical networks of French organizations and moving away from utilizing backdoors to evade detection.
This is according to a newly published report from
Tenable
Microsoft’s October 2023 Patch Tuesday Addresses 103 CVEs (CVE-2023-36563, CVE-2023-41763)
blogs_tenable·2023-10-10·CVSS 6.5
[MEDIUM] Microsoft’s October 2023 Patch Tuesday Addresses 103 CVEs (CVE-2023-36563, CVE-2023-41763)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
Top 10 Exploited Vulnerabilities in 2023: Insights from the Qualys Survey | Qualys
blogs_qualys·2023-09-26·CVSS 7.8
[HIGH] Top 10 Exploited Vulnerabilities in 2023: Insights from the Qualys Survey | Qualys
#### Table of Contents
- 7 Key Insights by the Qualys Threat Research Unit
- A Closer Look at the Top 10 Exploited Vulnerabilities of 2023
- Optimizing Risk Management with Qualys VMDR TruRiskDashboard
- Next Steps: Reduce Your Risk to the Top 10 Vulnerabilities with Qualys VMDR
- Additional Contributors:
The Qualys Threat Research Unit (TRU) has thoroughly analyzed vulnerabilities reported in 2023. Our comprehensive study assesses factors including weaponization status, existence in the CISA KEV, instances or usage of malware and ransomware, trending vulnerabilities, various scoring metrics, and recency of threats. Insights for the Top 10 vulnerabilities during 2023 are also based on evidence of exploitation, patch adoption rates, and the longevity of vulnerabilities.
## 7 Key Insights
Qualys
Qualys Survey of Top 10 Exploited Vulnerabilities in 2023
blogs_qualys·2023-09-26·CVSS 7.8
[HIGH] Qualys Survey of Top 10 Exploited Vulnerabilities in 2023
## Table of Contents
7 Key Insights by the Qualys Threat Research Unit
A Closer Look at the Top 10 Exploited Vulnerabilities of 2023
Optimizing Risk Management with Qualys VMDR TruRiskDashboard
Next Steps: Reduce Your Risk to the Top 10 Vulnerabilities with Qualys VMDR
Additional Contributors:
The Qualys Threat Research Unit (TRU) has thoroughly analyzed vulnerabilities reported in 2023. Our comprehensive study assesses factors including weaponization status, existence in the CISA KEV, instances or usage of malware and ransomware, trending vulnerabilities, various scoring metrics, and recency of threats. Insights for the Top 10 vulnerabilities during 2023 are also based on evidence of exploitation, patch adoption rates, and the longevity of vulnerabilities.
## 7 Key Insights by the
Tenable
Microsoft’s September 2023 Patch Tuesday Addresses 61 CVEs (CVE-2023-36761)
blogs_tenable·2023-09-12·CVSS 6.5
[MEDIUM] Microsoft’s September 2023 Patch Tuesday Addresses 61 CVEs (CVE-2023-36761)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Securelist
Lockbit leak, research opportunities on tools leaked from TAs
blogs_securelist·2023-08-25
Lockbit leak, research opportunities on tools leaked from TAs
Table of Contents
- Who abused these builders and how?
- GERT’s approach to analyzing the builder and payload
Authors
- Eduardo Ovalle
- Francesco Figurelli
Lockbit is one of the most prevalent ransomware strains. It comes with an affiliate ransomware-as-a-service (RaaS) program offering up to 80% of the ransom demand to participants, and includes a bug bounty program for those who detect and report vulnerabilities that allow files to be decrypted without paying the ransom. According to the Lockbit owners, the namesake cybercriminal group, there have been bounty payments of up to 50 thousand dollars. In addition to these features, Lockbit has offered a searchable portal to query leaked information from companies targeted by this ransomware family, and even offered payment to those who
Fortinet
FortiGuard Labs Discovers Multiple Vulnerabilities in Microsoft Message Queuing Service | FortiGuard Labs
blogs_fortinet·2023-07-24
FortiGuard Labs Discovers Multiple Vulnerabilities in Microsoft Message Queuing Service | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
FortiGuard Labs Discovers Multiple Vulnerabilities in Microsoft Message Queuing Service
By Wayne Low | July 24, 2023
Over the last few months, FortiGuard Labs has discovered and reported multiple vulnerabilities found in the Microsoft Message Queuing (MSMQ) service. Microsoft patched these vulnerabilities in the April and July 2023 security updates. These patches are rated as critical/important, and as always, we urge users to install them as soon as possible.
Affected platforms: Windows
Impacted parties: Microsoft Windows users with Microsoft Message Queuing service installed
Impact: Remote code execution and denial-of-service
Severity level: Critical and Important
In this post, we will walk through the attack surfaces of MSMQ, the approaches we took to
Securelist
Comprehensive analysis of initial attack samples exploiting CVE-2023-23397 vulnerability
blogs_securelist·2023-07-19·CVSS 9.8
CVE-2023-23397 [CRITICAL] Comprehensive analysis of initial attack samples exploiting CVE-2023-23397 vulnerability
Table of Contents
The CVE-2023-23397 vulnerability
The vulnerability fix
The WebDAV protocol
The samples
Sample list
Initial attack IOCs
Threat verification
A note about attacker infrastructure
Authors
Francesco Figurelli
Eduardo Ovalle
On March 14, 2023, Microsoft published a blogpost describing an Outlook Client Elevation of Privilege Vulnerability (CVSS: 9.8 CRITICAL). The publication generated a lot of activity among white, grey and black hat researchers, as well as lots of publications and tweets about the vulnerability and its exploitation. Below, we will highlight the key points and then focus on the initial use of this vulnerability by attackers before it became public.
Affected products include all supported versions of Microsoft Outlook for Windows. Other versions of
Securelist
Comprehensive analysis of initial attack samples exploiting CVE-2023-23397 vulnerability
blogs_securelist·2023-07-19·CVSS 9.8
CVE-2023-23397 [CRITICAL] Comprehensive analysis of initial attack samples exploiting CVE-2023-23397 vulnerability
Table of Contents
- The CVE-2023-23397 vulnerability
- The samples
- Sample list
- Initial attack IOCs
- Threat verification
- A note about attacker infrastructure
Authors
- Francesco Figurelli
- Eduardo Ovalle
On March 14, 2023, Microsoft published a blogpost describing an Outlook Client Elevation of Privilege Vulnerability (CVSS: 9.8 CRITICAL). The publication generated a lot of activity among white, grey and black hat researchers, as well as lots of publications and tweets about the vulnerability and its exploitation. Below, we will highlight the key points and then focus on the initial use of this vulnerability by attackers before it became public.
Affected products include all supported versions of Microsoft Outlook for Windows. Other versions of Microsoft Outlook, such as those
Securelist
Non-mobile malware statistics, Q1 2023
blogs_securelist·2023-06-07
Non-mobile malware statistics, Q1 2023
Table of Contents
- Quarterly figures
- Financial threats
- Ransomware programs
- Most prolific groups
- Miners
- Vulnerable applications used in cyberattacks
- Attacks on macOS
- IoT attacks
- Attacks via web resources
- Local threats
Authors
- AMR
- IT threat evolution in Q1 2023
- IT threat evolution in Q1 2023. Non-mobile statistics
- IT threat evolution in Q1 2023. Mobile statistics
These statistics are based on detection verdicts of Kaspersky products and services received from users who consented to providing statistical data.
## Quarterly figures
According to Kaspersky Security Network, in Q1 2023:
- Kaspersky solutions blocked 865,071,227 attacks launched from online resources across the globe.
- Web Anti-Virus detected 246,912,694 unique URLs.
- Attempts to run malware fo
Securelist
IT threat evolution in Q1 2023. Non-mobile statistics
blogs_securelist·2023-06-07
IT threat evolution in Q1 2023. Non-mobile statistics
Table of Contents
Quarterly figures
Financial threats
Financial threat statistics
Geography of financial malware attacks
Ransomware programs
Quarterly trends and highlights
Attacks on Linux and VMWare ESXi servers
Progress in combating cybercrime
Conti-based Trojan decrypted
Most prolific groups
Number of new modifications
Number of users attacked by ransomware Trojans
Geography of attacked users
TOP 10 most common families of ransomware Trojans
Miners
Number of new miner modifications
Number of users attacked by miners
Geography of miner attacks
Vulnerable applications used in cyberattacks
Quarterly highlights
Vulnerability statistics
Attacks on macOS
Geography of threats for macOS
IoT attacks
IoT threat statistics
Attacks via web resources
Countries/territories
Fortinet
Exploring a Recent Microsoft Outlook Vulnerability: CVE-2023-23397 | FortiGuard Labs
blogs_fortinet·2023-04-12·CVSS 9.8
CVE-2023-23397 [CRITICAL] Exploring a Recent Microsoft Outlook Vulnerability: CVE-2023-23397 | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
Exploring a Recent Microsoft Outlook Vulnerability: CVE-2023-23397
By Emily Chen | April 12, 2023
FortiGuard Labs recently investigated an Elevation of Privilege vulnerability in Microsoft Outlook that can be exploited by sending a crafted email to a vulnerable version of the software. When the victim receives the email, an attempt to connect to an attacker’s device is triggered, resulting in the victim’s NTLMv2 hash being leaked.
The vulnerable property resides in the PidLidReminderFileParameter extended MAPI property, which specifies the filename of a sound to be played when a reminder for an object is overdue.
Figure 1: Reminder Dialog to Customize a Sound
To trigger the vulnerability, the sender simply modifies the PidLidReminderFileParameter messag
Wiz
The First Edition of Crying Out Cloud - The Newsletter! | Wiz
blogs_wiz·2023-04-11·CVSS 6.7
CVE-2023-25610 [MEDIUM] The First Edition of Crying Out Cloud - The Newsletter! | Wiz
The world of cloud security is ever-evolving, and the Wiz Research team is here to keep you updated. This month several impactful vulnerabilities were published, and we observed a few unfortunate security incidents which should be of interest to cloud customers.
Here's a summary of our top picks, enjoy!
## ✨ Highlights
## 🐞 High Profile Vulnerabilities
## Critical RCE vulnerability in Fortinet's FortiOS and FortiProxy
On March 7, Fortinet published an advisory for CVE-2023-25610, a critical buffer underwrite vulnerability in FortiOS. This vulnerability is a bug in the administrative interface which could allow a remote unauthenticated attacker to execute code using specially crafted requests. Based on Wiz data, 7% of cloud enterprise environments are still susceptible to this vulnerab
Unit42
Threat Brief - CVE-2023-23397 - Microsoft Outlook Privilege Escalation
blogs_unit42·2023-03-31·CVSS 9.8
CVE-2023-23397 [CRITICAL] Threat Brief - CVE-2023-23397 - Microsoft Outlook Privilege Escalation
## Executive Summary
On March 14, 2023, Microsoft released a patch for CVE-2023-23397. CVE-2023-23397 is a vulnerability in the Windows Microsoft Outlook client that can be exploited by sending a specially crafted email that triggers automatically when it is processed by the Outlook client. No user interaction is required to trigger the exploit.
Exploitation of the vulnerability will leak the targeted user’s Net-NTLMv2 hashes. This could then be used to conduct relay attacks to other systems that support NTLMv2, allowing the threat actor to authenticate as the targeted user.
Relay attacks are much more effective when the threat actor already has a foothold into the targeted network. This is because Windows New Technology LAN Manager (NTLM) authentication is commonly used within an Activ
Unit42
Threat Brief - CVE-2023-23397 - Microsoft Outlook Privilege Escalation
blogs_unit42·2023-03-31·CVSS 9.8
CVE-2023-23397 [CRITICAL] Threat Brief - CVE-2023-23397 - Microsoft Outlook Privilege Escalation
Threat Research Center
High Profile Threats
Vulnerabilities
## Threat Brief - CVE-2023-23397 - Microsoft Outlook Privilege Escalation
Unit 42
Published: March 31, 2023
High Profile Threats
Threat Research
Vulnerabilities
CVE-2023-23397
Email compromise
Microsoft Outlook
Microsoft Vulnerability
## Executive Summary
On March 14, 2023, Microsoft released a patch for CVE-2023-23397 . CVE-2023-23397 is a vulnerability in the Windows Microsoft Outlook client that can be exploited by sending a specially crafted email that triggers automatically when it is processed by the Outlook client. No user interaction is required to trigger the exploit.
Exploitation of the vulnerability will leak the targeted user’s Net-NTLMv2 hashes. This could then be used to conduct relay attacks to ot
Sentinelone
CVE-2023-23397: Microsoft Outlook Elevation of Privilege Vulnerability
blogs_sentinelone·2023-03-29·CVSS 9.8
CVE-2023-23397 [CRITICAL] CVE-2023-23397: Microsoft Outlook Elevation of Privilege Vulnerability
CVE-2023-23397 is a critical privilege elevation/authentication bypass vulnerability in Microsoft Outlook that was assigned a 9.8 CVSS rating. It is an elevation of privilege (EoP) vulnerability in Microsoft Outlook that allows a threat actor to send a specially crafted email with a malicious payload that will cause the victim’s Outlook client to automatically connect to a Universal Naming Convention (UNC) location under the actor’s control to receive the Net-NTLMv2 user’s password hash. This vulnerability affects all versions of Windows Outlook.
## what is an NTLMv2 hash?
The Windows authentication system uses NTLMv2, which is a challenge-response protocol. When a server or service requests authentication from a user, the user must respond with a hashed representation of their credentia
Sentinelone
CVE-2023-23397: Microsoft Outlook Elevation of Privilege Vulnerability
blogs_sentinelone·2023-03-29·CVSS 9.8
CVE-2023-23397 [CRITICAL] CVE-2023-23397: Microsoft Outlook Elevation of Privilege Vulnerability
CVE-2023-23397 is a critical privilege elevation/authentication bypass vulnerability in Microsoft Outlook that was assigned a 9.8 CVSS rating. It is an elevation of privilege (EoP) vulnerability in Microsoft Outlook that allows a threat actor to send a specially crafted email with a malicious payload that will cause the victim’s Outlook client to automatically connect to a Universal Naming Convention (UNC) location under the actor’s control to receive the Net-NTLMv2 user’s password hash. This vulnerability affects all versions of Windows Outlook.
## what is an NTLMv2 hash?
The Windows authentication system uses NTLMv2, which is a challenge-response protocol. When a server or service requests authentication from a user, the user must respond with a hashed representation of their credentia
Talos
Threat Source newsletter (March 23, 2023) — Meta is threatening to ban news sharing in Canada. Good.
blogs_talos·2023-03-23
Threat Source newsletter (March 23, 2023) — Meta is threatening to ban news sharing in Canada. Good.
Welcome to this week’s edition of the Threat Source newsletter.
After asking ChatGPT to write the newsletter for me two weeks ago, I was tempted to have Google’s Bard do the same, but I resisted making this the newsletter’s new gimmick.
Instead, I wanted to write about another tech giant — Meta.
The company recently doubled down on a threat to remove news links and sharing from its Facebook and Instagram platforms if Canada passes its proposed Online News Act, or bill C-18. The proposed legislation would compel companies like Meta and Google to sign agreements with Canadian news organizations that would pay them each time a user clicks on a news link through one of their platforms (i.e., via a shared link on Facebook or a Google search result).
But as the great Tobey Maguire once said
Talos
Threat Source newsletter (March 23, 2023) — Meta is threatening to ban news sharing in Canada. Good.
blogs_talos·2023-03-23
Threat Source newsletter (March 23, 2023) — Meta is threatening to ban news sharing in Canada. Good.
## Threat Source newsletter (March 23, 2023) — Meta is threatening to ban news sharing in Canada. Good.
Welcome to this week’s edition of the Threat Source newsletter.
After asking ChatGPT to write the newsletter for me two weeks ago, I was tempted to have Google’s Bard do the same, but I resisted making this the newsletter’s new gimmick.
Instead, I wanted to write about another tech giant — Meta.
The company recently doubled down on a threat to remove news links and sharing from its Facebook and Instagram platforms if Canada passes its proposed Online News Act, or bill C-18. The proposed legislation would compel companies like Meta and Google to sign agreements with Canadian news organizations that would pay them each time a user clicks on a news link through one of their platforms (i
Sentinelone
Cloud Security | How to Successfully Manage Essential Roles and Responsibilities
blogs_sentinelone·2023-03-21
Cloud Security | How to Successfully Manage Essential Roles and Responsibilities
Protecting company data from cyber threats is an essential and ongoing responsibility for enterprises of all sizes. As more organizations shift their operations to the cloud , establishing a reliable cloud security posture has become crucial. As a result, a team of experts, including the cloud security team, DevOps, platform engineering, and compliance, play integral roles in managing and maintaining cloud security.
Investing in a robust cloud security team equips businesses with the necessary tools to secure their operations against potential cyberattacks in a fast-paced, digital world. In this post, we explore the different roles, responsibilities and best practices for effective cloud security management .
## Cloud Security Management | Building A Team to Support The Strategy
Cloud s
Trendmicro
Patch CVE-2023-23397 Immediately: What You Need To Know and Do
blogs_trendmicro·2023-03-21·CVSS 7.8
CVE-2023-23397 [HIGH] Patch CVE-2023-23397 Immediately: What You Need To Know and Do
Sfruttamento vulnerabilità
## Patch CVE-2023-23397 Immediately: What You Need To Know and Do
We break down the basic information of CVE-2023-23397, the zero-day, zero-touch vulnerability that was rated 9.8 on the Common Vulnerability Scoring System (CVSS) scale.
By: Trend Micro Mar 21, 2023 Read time: ( words)
Save to Folio
Update as of 03/22/3023 2:50PM PHT: Updated the prevention and mitigation section for an additional step.
CVE-2023-23397 is a critical privilege elevation/authentication bypass vulnerability in Outlook, released as part of the March Patch Tuesday set of fixes. The vulnerability, which affects all versions of Windows Outlook, was given a 9.8 CVSS rating and is one of two zero-day exploits disclosed on March 14. We summarize the points that security teams need to kn
Trendmicro
Patch CVE-2023-23397 Immediately: What You Need To Know and Do
blogs_trendmicro·2023-03-21·CVSS 7.8
CVE-2023-23397 [HIGH] Patch CVE-2023-23397 Immediately: What You Need To Know and Do
Ausnutzung von Schwachstellen
## Patch CVE-2023-23397 Immediately: What You Need To Know and Do
We break down the basic information of CVE-2023-23397, the zero-day, zero-touch vulnerability that was rated 9.8 on the Common Vulnerability Scoring System (CVSS) scale.
By: Trend Micro Mar 21, 2023 Read time: ( words)
Save to Folio
Update as of 03/22/3023 2:50PM PHT: Updated the prevention and mitigation section for an additional step.
CVE-2023-23397 is a critical privilege elevation/authentication bypass vulnerability in Outlook, released as part of the March Patch Tuesday set of fixes. The vulnerability, which affects all versions of Windows Outlook, was given a 9.8 CVSS rating and is one of two zero-day exploits disclosed on March 14. We summarize the points that security teams need to
Trendmicro
Patch CVE-2023-23397 Immediately: What You Need To Know and Do
blogs_trendmicro·2023-03-21·CVSS 7.8
CVE-2023-23397 [HIGH] Patch CVE-2023-23397 Immediately: What You Need To Know and Do
Exploits & Vulnerabilities
## Patch CVE-2023-23397 Immediately: What You Need To Know and Do
We break down the basic information of CVE-2023-23397, the zero-day, zero-touch vulnerability that was rated 9.8 on the Common Vulnerability Scoring System (CVSS) scale.
By: Trend Micro Mar 21, 2023 Read time: ( words)
Save to Folio
Update as of 03/22/3023 2:50PM PHT: Updated the prevention and mitigation section for an additional step.
CVE-2023-23397 is a critical privilege elevation/authentication bypass vulnerability in Outlook, released as part of the March Patch Tuesday set of fixes. The vulnerability, which affects all versions of Windows Outlook, was given a 9.8 CVSS rating and is one of two zero-day exploits disclosed on March 14. We summarize the points that security teams need to kn
Trendmicro
Patch CVE-2023-23397 Immediately: What You Need To Know and Do
blogs_trendmicro·2023-03-21·CVSS 7.8
CVE-2023-23397 [HIGH] Patch CVE-2023-23397 Immediately: What You Need To Know and Do
Exploits & Vulnerabilities
## Patch CVE-2023-23397 Immediately: What You Need To Know and Do
We break down the basic information of CVE-2023-23397, the zero-day, zero-touch vulnerability that was rated 9.8 on the Common Vulnerability Scoring System (CVSS) scale.
By: Trend Micro 2023/03/21 Read time: ( words)
Save to Folio
Update as of 03/22/3023 2:50PM PHT: Updated the prevention and mitigation section for an additional step.
CVE-2023-23397 is a critical privilege elevation/authentication bypass vulnerability in Outlook, released as part of the March Patch Tuesday set of fixes. The vulnerability, which affects all versions of Windows Outlook, was given a 9.8 CVSS rating and is one of two zero-day exploits disclosed on March 14. We summarize the points that security teams need to know
Trendmicro
Patch CVE-2023-23397 Immediately: What You Need To Know and Do
blogs_trendmicro·2023-03-21·CVSS 7.8
CVE-2023-23397 [HIGH] Patch CVE-2023-23397 Immediately: What You Need To Know and Do
Exploits y vulnerabilidades
## Patch CVE-2023-23397 Immediately: What You Need To Know and Do
We break down the basic information of CVE-2023-23397, the zero-day, zero-touch vulnerability that was rated 9.8 on the Common Vulnerability Scoring System (CVSS) scale.
By: Trend Micro Mar 21, 2023 Read time: ( words)
Save to Folio
Update as of 03/22/3023 2:50PM PHT: Updated the prevention and mitigation section for an additional step.
CVE-2023-23397 is a critical privilege elevation/authentication bypass vulnerability in Outlook, released as part of the March Patch Tuesday set of fixes. The vulnerability, which affects all versions of Windows Outlook, was given a 9.8 CVSS rating and is one of two zero-day exploits disclosed on March 14. We summarize the points that security teams need to k
Trendmicro
Patch CVE-2023-23397 Immediately: What You Need To Know and Do
blogs_trendmicro·2023-03-21·CVSS 9.8
CVE-2023-23397 [CRITICAL] Patch CVE-2023-23397 Immediately: What You Need To Know and Do
Exploits & Vulnerabilities
# Patch CVE-2023-23397 Immediately: What You Need To Know and Do
We break down the basic information of CVE-2023-23397, the zero-day, zero-touch vulnerability that was rated 9.8 on the Common Vulnerability Scoring System (CVSS) scale.
By: Trend Micro
2023/03/21
Read time: ( words)
Save to Folio
Update as of 03/22/3023 2:50PM PHT: Updated the prevention and mitigation section for an additional step.
CVE-2023-23397 is a critical privilege elevation/authentication bypass vulnerability in Outlook, released as part of the March Patch Tuesday set of fixes. The vulnerability, which affects all versions of Windows Outlook, was given a 9.8 CVSS rating and is one of two zero-day exploits disclosed on March 14. We summarize the points that security teams need to know
Checkpoint
20th March – Threat Intelligence Report
blogs_checkpoint·2023-03-20·CVSS 7.1
CVE-2023-0669 [HIGH] 20th March – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 20th March – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 20th March, please download our Threat_Intelligence Bulletin
TOP ATTACKS AND BREACHES
Hitachi Energy reported a data breach caused by the Clop ransomware group which exploited a zero-day vulnerability (CVE-2023-0669) in the Fortra GoAnywhere MFT system, which was used by Hitachi.
Check Point IPS, Threat Emulation and Harmony Endpoint provide protection against this threat (GoAnywhere MFT Insecure Deserializatio
Zscaler
CVE-2023-23397 | ThreatLabz
blogs_zscaler·2023-03-17·CVSS 9.8
[CRITICAL] CVE-2023-23397 | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Huntress
Everything We Know About CVE-2023-23397 | Huntress
blogs_huntress·2023-03-17·CVSS 9.8
CVE-2023-23397 [CRITICAL] Everything We Know About CVE-2023-23397 | Huntress
Huntress has been tracking CVE-2023-23397 , a critical vulnerability/0-day that impacts Microsoft Outlook. Unlike other exploits we’ve seen in the past, this exploit is particularly dangerous because no user interaction is required to trigger the exploit . Once an infected email arrives in a Microsoft Outlook inbox, sensitive credential hashes can be obtained.
On Patch Tuesday, Microsoft released a patch to remedy the vulnerability, so we recommend immediately patching to protect yourself and your environments from this dangerous exploit. All supported versions of Microsoft Outlook for Windows are impacted to include the locally installed Outlook from M365. Other versions of Microsoft Outlook such as Android, iOS, Mac as well as Outlook on the web and other M365 services on the web are no
Talos
Threat Source newsletter (March 16, 2023) — A deep dive into Talos' work in Ukraine
blogs_talos·2023-03-16
Threat Source newsletter (March 16, 2023) — A deep dive into Talos' work in Ukraine
Welcome to this week’s edition of the Threat Source newsletter.
We’re written a ton about Cisco Talos’ support of Ukraine and our friends and allies there. Now, we encourage you to watch and listen to the folks who have been working hands-on there.
The latest episode of ThreatWise TV from Hazel Burton is the closest look yet at the team Talos assembled in the days after Russia invaded Ukraine to help defend critical infrastructure, intelligence partners and government agencies in Ukraine. You can watch the full documentary above, or over on YouTube here.
## The one big thing
We have new research out on a never-before-seen threat actor called YoroTrooper that’s carrying out a variety of espionage activity in Europe and Asia. This group has targeted several high-profile government organi
Talos
Threat Source newsletter (March 16, 2023) — A deep dive into Talos' work in Ukraine
blogs_talos·2023-03-16
Threat Source newsletter (March 16, 2023) — A deep dive into Talos' work in Ukraine
## Threat Source newsletter (March 16, 2023) — A deep dive into Talos' work in Ukraine
Welcome to this week’s edition of the Threat Source newsletter.
We’re written a ton about Cisco Talos’ support of Ukraine and our friends and allies there. Now, we encourage you to watch and listen to the folks who have been working hands-on there.
The latest episode of ThreatWise TV from Hazel Burton is the closest look yet at the team Talos assembled in the days after Russia invaded Ukraine to help defend critical infrastructure, intelligence partners and government agencies in Ukraine. You can watch the full documentary above, or over on YouTube here .
## The one big thing
We have new research out on a never-before-seen threat actor called YoroTrooper that’s carrying out a variety of espionage ac
Krebs
Microsoft Patch Tuesday, March 2023 Edition
blogs_krebs·2023-03-15·CVSS 9.8
CVE-2023-23397 [CRITICAL] Microsoft Patch Tuesday, March 2023 Edition
Microsoft on Tuesday released updates to quash at least 74 security bugs in its Windows operating systems and software. Two of those flaws are already being actively attacked, including an especially severe weakness in Microsoft Outlook that can be exploited without any user interaction.
The Outlook vulnerability (CVE-2023-23397) affects all versions of Microsoft Outlook from 2013 to the newest. Microsoft said it has seen evidence that attackers are exploiting this flaw, which can be done without any user interaction by sending a booby-trapped email that triggers automatically when retrieved by the email server — before the email is even viewed in the Preview Pane.
While CVE-2023-23397 is labeled as an “Elevation of Privilege” vulnerability, that label doesn’t accurately reflect its seve
Qualys
The March 2023 Patch Tuesday Security Update Review | Qualys
blogs_qualys·2023-03-15·CVSS 9.8
[CRITICAL] The March 2023 Patch Tuesday Security Update Review | Qualys
#### Table of Contents
- Microsoft Patches for March 2023
- Adobe Patches for March 2023
- Zero-day Vulnerabilities Patched in March Patch Tuesday Edition
- Other Critical Severity Vulnerabilities Patched in March Patch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response withPatch Management (PM)
- EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
- Qualys Monthly Webinar Series
- This Month in Vulnerabilities & Patches
Microsoft has released its monthly security update for March 2023. This month’s updates addressed various vulnerabilities in different products. Let’s go through this month’s Patch Tuesday details and discuss
Krebs
Microsoft Patch Tuesday, March 2023 Edition
blogs_krebs·2023-03-15·CVSS 9.8
CVE-2023-23397 [CRITICAL] Microsoft Patch Tuesday, March 2023 Edition
Microsoft on Tuesday released updates to quash at least 74 security bugs in its Windows operating systems and software. Two of those flaws are already being actively attacked, including an especially severe weakness in Microsoft Outlook that can be exploited without any user interaction.
The Outlook vulnerability ( CVE-2023-23397 ) affects all versions of Microsoft Outlook from 2013 to the newest. Microsoft said it has seen evidence that attackers are exploiting this flaw, which can be done without any user interaction by sending a booby-trapped email that triggers automatically when retrieved by the email server — before the email is even viewed in the Preview Pane .
While CVE-2023-23397 is labeled as an “Elevation of Privilege” vulnerability, that label doesn’t accurately reflect its s
Talos
Threat Advisory: Microsoft Outlook privilege escalation vulnerability being exploited in the wild
blogs_talos·2023-03-15·CVSS 9.8
[CRITICAL] Threat Advisory: Microsoft Outlook privilege escalation vulnerability being exploited in the wild
## Threat Advisory: Microsoft Outlook privilege escalation vulnerability being exploited in the wild
Update March 21, 2023: To aid defenders trying to detect and mitigate this vulnerability, we are providing a couple of additional resources. First, we are providing a ClamAV signature that detects this threat — the rule can be found on our GitHub here and can be leveraged anywhere ClamAV signatures are supported. We are also working to provide some resources to ESA customers related to this vulnerability. There is a filter on our GitHub (created by Bartosz Kozak ) that can be applied as a filter using these instructions . Please note that filters can slow down your inbox, so please use caution when applying. If the ESA Administrator would prefer to rely on Cisco Secure Endpoint + Secure Ma
Talos
Threat Advisory: Microsoft Outlook privilege escalation vulnerability being exploited in the wild
blogs_talos·2023-03-15·CVSS 9.8
CVE-2023-23397 [CRITICAL] Threat Advisory: Microsoft Outlook privilege escalation vulnerability being exploited in the wild
Update March 21, 2023: To aid defenders trying to detect and mitigate this vulnerability, we are providing a couple of additional resources. First, we are providing a ClamAV signature that detects this threat — the rule can be found on our GitHub here and can be leveraged anywhere ClamAV signatures are supported. We are also working to provide some resources to ESA customers related to this vulnerability. There is a filter on our GitHub (created by Bartosz Kozak) that can be applied as a filter using these instructions.
Please note that filters can slow down your inbox, so please use caution when applying. If the ESA Administrator would prefer to rely on Cisco Secure Endpoint + Secure Malware Analytics integration to avoid performance impacts that option is also available. That does requi
Qualys
The March 2023 Patch Tuesday Security Update Review
blogs_qualys·2023-03-15·CVSS 9.8
[CRITICAL] The March 2023 Patch Tuesday Security Update Review
## Table of Contents
Microsoft Patches for March 2023
Adobe Patches for March 2023
Zero-day Vulnerabilities Patched in March Patch Tuesday Edition
Other Critical Severity Vulnerabilities Patched in March Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response withPatch Management (PM)
EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
Qualys Monthly Webinar Series
This Month in Vulnerabilities & Patches
Microsoft has released its monthly security update for March 2023. This month’s updates addressed various vulnerabilities in different products. Let’s go through this month’s Patch Tuesday details and discuss the security
Talos
Microsoft Patch Tuesday for March 2023 — Snort rules and prominent vulnerabilities
blogs_talos·2023-03-14·CVSS 9.8
[CRITICAL] Microsoft Patch Tuesday for March 2023 — Snort rules and prominent vulnerabilities
## Microsoft Patch Tuesday for March 2023 — Snort rules and prominent vulnerabilities
Microsoft released its monthly security update Tuesday, disclosing 83 vulnerabilities across the company’s hardware and software line, including two issues that are actively being exploited in the wild, continuing a trend of zero-days appearing in Patch Tuesdays over the past few months.
Two of the vulnerabilities included in March’s security update have been exploited in the wild, according to Microsoft, including one critical issue.
In all, eight of the issues disclosed this month are critical, while the remainder — outside of one — is “important.”
A moderate-severity vulnerability that’s already being exploited in the wild is CVE-2023-24880 , a security feature bypass vulnerability in Windows Smart
Talos
Microsoft Patch Tuesday for March 2023 — Snort rules and prominent vulnerabilities
blogs_talos·2023-03-14·CVSS 9.8
[CRITICAL] Microsoft Patch Tuesday for March 2023 — Snort rules and prominent vulnerabilities
Microsoft released its monthly security update Tuesday, disclosing 83 vulnerabilities across the company’s hardware and software line, including two issues that are actively being exploited in the wild, continuing a trend of zero-days appearing in Patch Tuesdays over the past few months.
Two of the vulnerabilities included in March’s security update have been exploited in the wild, according to Microsoft, including one critical issue.
In all, eight of the issues disclosed this month are critical, while the remainder — outside of one — is “important.”
A moderate-severity vulnerability that’s already being exploited in the wild is CVE-2023-24880, a security feature bypass vulnerability in Windows SmartScreen, a cloud-based anti-phishing and anti-malware feature included in several Microso
Tenable
Microsoft’s March 2023 Patch Tuesday Addresses 76 CVEs (CVE-2023-23397)
blogs_tenable·2023-03-14·CVSS 9.8
[CRITICAL] Microsoft’s March 2023 Patch Tuesday Addresses 76 CVEs (CVE-2023-23397)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Sentinelone
Black Basta
blogs_sentinelone·2022-11-30
Black Basta
How It Works The Singularity XDR Difference
Singularity Marketplace One-Click Integrations to Unlock the Power of XDR
Pricing & Packaging Comparisons and Guidance at a Glance
Purple AI Accelerate SecOps with Generative AI
Singularity Hyperautomation Easily Automate Security Processes
AI-SIEM The AI SIEM for the Autonomous SOC
Singularity Data Lake AI-Powered, Unified Data Lake
Singularity Data Lake for Log Analytics Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
Singularity Endpoint Autonomous Prevention, Detection, and Response
Singularity XDR Native & Open Protection, Detection, and Response
Singularity RemoteOps Forensics Orchestrate Forensics at Scale
Singularity
Threat Intelligence Comprehensive Adversary Intelligence
Singularity Vulnerability Management
Fortinet
Fortinet Researcher Discover Vulnerabilities in Siemens Solutions: PADS Standard Layout Viewer and PADS Standard Plus Layout Viewer | FortiGuard Labs
blogs_fortinet·2022-07-15·CVSS 7.8
CVE-2022-34272 [HIGH] Fortinet Researcher Discover Vulnerabilities in Siemens Solutions: PADS Standard Layout Viewer and PADS Standard Plus Layout Viewer | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
Fortinet Researcher Discover Vulnerabilities in Siemens Solutions: PADS Standard Layout Viewer and PADS Standard Plus Layout Viewer
By Kushal Arvind Shah | July 15, 2022
In late May, 2022, I discovered and reported multiple zero-day vulnerabilities in the Siemens PADS Layout Viewer solutions. This week (July 12, 2022), Siemens published their advisories for the same.
These vulnerabilities are identified as CVE-2022-34272, CVE-2022-34273, CVE-2022-34274, CVE-2022-34275, CVE-2022-34276, CVE-2022-34277, CVE-2022-34278, CVE-2022-34279, CVE-2022-34280, CVE-2022-34281, CVE-2022-34282, CVE-2022-34283, CVE-2022-34284, CVE-2022-34285, CVE-2022-34286, CVE-2022-34287, CVE-2022-34288, CVE-2022-34289, CVE-2022-34290, and CVE-2022-34291.
Each of these is the result of
Trendmicro
Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
blogs_trendmicro
Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
APT und gezielte Angriffe
## Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
Based on our estimates, from approximately April 2022 until November 2023, Pawn Storm attempted to launch NTLMv2 hash relay attacks through different methods, with huge peaks in the number of targets and variations in the government departments that it targeted.
By: Feike Hacquebord, Fernando Merces April 03, 2026 Read time: ( words)
Save to Folio
Armed forces
Europe, South America
Central bank
Middle East
City council
Asia, Europe, Middle East, North America, Africa
Defense industry
Europe , North America, South America
Aerospace industry
Europe
Electricity authority
Europe, Middle East
Energy sector
Europe
Intellectual property authority
Middle East
Ministry of Agriculture
Recorded Future
BlueDelta Exploits Ukrainian Government Roundcube Mail Servers to Support Espionage Activities
blogs_recorded_future·CVSS 9.8
[CRITICAL] BlueDelta Exploits Ukrainian Government Roundcube Mail Servers to Support Espionage Activities
# BlueDelta Exploits Ukrainian Government Roundcube Mail Servers to Support Espionage Activities
Recorded Future's Insikt Group, in partnership with Ukraine's Computer Emergency Response Team (CERT-UA), has uncovered a campaign targeting high-profile entities in Ukraine that was cross-correlated with a spearphishing campaign uncovered by Recorded Future’s Network Traffic Intelligence. The campaign leveraged news about Russia’s war against Ukraine to encourage recipients to open emails, which immediately compromised vulnerable Roundcube servers (an open-source webmail software), using CVE-2020-35730, without engaging with the attachment. We found that the campaign overlaps with historic BlueDelta activity exploiting the Microsoft Outlook zero-day vulnerability CVE-2023-23397 in 2022.
The
Trendmicro
Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
blogs_trendmicro
Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
APT & Targeted Attacks
## Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
Based on our estimates, from approximately April 2022 until November 2023, Pawn Storm attempted to launch NTLMv2 hash relay attacks through different methods, with huge peaks in the number of targets and variations in the government departments that it targeted.
By: Feike Hacquebord, Fernando Merces September 22, 2025 Read time: ( words)
Save to Folio
Armed forces
Europe, South America
Central bank
Middle East
City council
Asia, Europe, Middle East, North America, Africa
Defense industry
Europe , North America, South America
Aerospace industry
Europe
Electricity authority
Europe, Middle East
Energy sector
Europe
Intellectual property authority
Middle East
Ministry of Agricultur
Recorded Future
Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign
blogs_recorded_future·CVSS 9.8
[CRITICAL] Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign
# Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign
Recorded Future’s Insikt Group has identified TAG-70, a threat actor likely operating on behalf of Belarus and Russia, conducting cyber-espionage against government, military, and national infrastructure entities in Europe and Central Asia since at least December 2020. TAG-70 overlaps with activity reported by other security vendors under the aliases Winter Vivern, TA473, and UAC-0114.
In its latest campaign, which ran between October and December 2023, TAG-70 exploited cross-site scripting (XSS) vulnerabilities in Roundcube webmail servers in its targeting of over 80 organizations, primarily in Georgia, Poland, and Ukraine. This campaign has been linked to additional TAG-70 activity a
Trendmicro
Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
blogs_trendmicro
Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
APT y ataques dirigidos
## Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
Based on our estimates, from approximately April 2022 until November 2023, Pawn Storm attempted to launch NTLMv2 hash relay attacks through different methods, with huge peaks in the number of targets and variations in the government departments that it targeted.
By: Feike Hacquebord, Fernando Merces April 03, 2026 Read time: ( words)
Save to Folio
Armed forces
Europe, South America
Central bank
Middle East
City council
Asia, Europe, Middle East, North America, Africa
Defense industry
Europe , North America, South America
Aerospace industry
Europe
Electricity authority
Europe, Middle East
Energy sector
Europe
Intellectual property authority
Middle East
Ministry of Agriculture
Crowdstrike
March 2023 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] March 2023 Patch Tuesday: Updates and Analysis
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand AT
Recorded Future
BlueDelta Exploits Ukrainian Government Roundcube Mail Servers to Support Espionage Activities | Recorded Future
blogs_recorded_future·CVSS 9.8
[CRITICAL] BlueDelta Exploits Ukrainian Government Roundcube Mail Servers to Support Espionage Activities | Recorded Future
## BlueDelta Exploits Ukrainian Government Roundcube Mail Servers to Support Espionage Activities
Recorded Future's Insikt Group, in partnership with Ukraine's Computer Emergency Response Team (CERT-UA), has uncovered a campaign targeting high-profile entities in Ukraine that was cross-correlated with a spearphishing campaign uncovered by Recorded Future’s Network Traffic Intelligence. The campaign leveraged news about Russia’s war against Ukraine to encourage recipients to open emails, which immediately compromised vulnerable Roundcube servers (an open-source webmail software), using CVE-2020-35730 , without engaging with the attachment. We found that the campaign overlaps with historic BlueDelta activity exploiting the Microsoft Outlook zero-day vulnerability CVE-2023-23397 in 2022.
Th
Zscaler
CISO Monthly Roundup, March 2023: APT37 info leak, 3CX supply chain attack, OneNote spreads malware, Nevada ransomware, dissecting DBatLoader, and CVE-2023-23397 | CXO Revolutionaries
blogs_zscaler·CVSS 9.8
CVE-2023-23397 [CRITICAL] CISO Monthly Roundup, March 2023: APT37 info leak, 3CX supply chain attack, OneNote spreads malware, Nevada ransomware, dissecting DBatLoader, and CVE-2023-23397 | CXO Revolutionaries
## CISO Monthly Roundup, March 2023: APT37 info leak, 3CX supply chain attack, OneNote spreads malware, Nevada ransomware, dissecting DBatLoader, and CVE-2023-23397
Deepen Desai
Contributor
Zscaler
## Mar 30, 2023
The March CISO Monthly Roundup pulls back the curtain on APT37, examined the 3CX supply chain attack, flags OneNote as a malware spreader, and more.
The CISO Monthly Roundup provides the latest threat research from Deepen Desai and the ThreatLabz team, along with insights on other cyber-related subjects. Over the past month, ThreatLabz captured leaked info from APT37, examined the 3CX supply chain attack, studied malicious OneNote use, analyzed Nevada ransomware, performed a deep-dive on DBatLoader, and released a CVE advisory.
## Uncovering secrets of APT37
APT37, also k
Huntress
CVE-2023-23397 Vulnerability: Analysis, Detection, Removal | Huntress
blogs_huntress·CVSS 9.8
CVE-2023-23397 [CRITICAL] CVE-2023-23397 Vulnerability: Analysis, Detection, Removal | Huntress
## CVE-2023-23397 Vulnerability
Published: 12/05/2025
Written by: Lizzie Danielson
## What is CVE-2023-23397 vulnerability?
CVE-2023-23397 is a remote code execution (RCE) vulnerability in Microsoft Outlook, first disclosed in March 2023. This vulnerability enables threat actors to exploit a privilege escalation flaw by crafting malicious emails containing a UUID link, which prompts NTLM authentication. What makes this vulnerability particularly dangerous is that it requires no user interaction, making it a severe threat to enterprise environments.
## When was it discovered?
The CVE-2023-23397 vulnerability was first discovered by Microsoft’s Threat Intelligence team and disclosed on March 14, 2023. Microsoft issued an advisory detailing the vulnerability’s impact, with additional in
Recorded Future
Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign
blogs_recorded_future·CVSS 9.8
[CRITICAL] Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign
## Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign
Recorded Future’s Insikt Group has identified TAG-70, a threat actor likely operating on behalf of Belarus and Russia, conducting cyber-espionage against government, military, and national infrastructure entities in Europe and Central Asia since at least December 2020. TAG-70 overlaps with activity reported by other security vendors under the aliases Winter Vivern, TA473, and UAC-0114.
In its latest campaign, which ran between October and December 2023, TAG-70 exploited cross-site scripting (XSS) vulnerabilities in Roundcube webmail servers in its targeting of over 80 organizations, primarily in Georgia, Poland, and Ukraine. This campaign has been linked to additional TAG-70 activity
Sentinelone
Black Basta
blogs_sentinelone
Black Basta
# Black Basta Ransomware: In-Depth Analysis, Detection, and Mitigation
## Summary of Black Basta Ransomware
Black Basta first emerged in early 2022. The ransomware family is an evolution of the Hermes/Ryuk/Conti families. Black Basta was heavily advertised in underground cybercrime markets. Black Basta practices double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data. There are Windows and LInux variants of Black Basta ransomware. The group is responsible for hundreds of attacks against global targets of varying sectors.
February 2025 Update: Nearly a year’s worth of Black Basta chat logs have been released on Telegram, providing detailed insight into the groups operational workflow, reconnaissance activities, and specific userID and details o
Trendmicro
Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
blogs_trendmicro
Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
APT & Targeted Attacks
# Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
Based on our estimates, from approximately April 2022 until November 2023, Pawn Storm attempted to launch NTLMv2 hash relay attacks through different methods, with huge peaks in the number of targets and variations in the government departments that it targeted.
By: Feike Hacquebord, Fernando Merces
September 22, 2025
Read time: ( words)
Save to Folio
Introduction
Pawn Storm (also known as APT28 and Forest Blizzard) is an advanced persistent threat (APT) actor that shows incessant and lasting repetitions in its tactics, techniques, and procedures (TTPs). Some of the group’s campaigns involve using the same kind of technical tricks repeatedly, sometimes targeting hundreds of people in a singl
Huntress
Everything We Know About CVE-2023-23397 | Huntress
blogs_huntress·CVSS 9.8
CVE-2023-23397 [CRITICAL] Everything We Know About CVE-2023-23397 | Huntress
Huntress has been tracking CVE-2023-23397, a critical vulnerability/0-day that impacts Microsoft Outlook. Unlike other exploits we’ve seen in the past, this exploit is particularly dangerous because no user interaction is required to trigger the exploit. Once an infected email arrives in a Microsoft Outlook inbox, sensitive credential hashes can be obtained.
On Patch Tuesday, Microsoft released a patch to remedy the vulnerability, so we recommend immediately patching to protect yourself and your environments from this dangerous exploit. All supported versions of Microsoft Outlook for Windows are impacted to include the locally installed Outlook from M365. Other versions of Microsoft Outlook such as Android, iOS, Mac as well as Outlook on the web and other M365 services on the web are not
arXiv
CyGATE: Game-Theoretic Cyber Attack-Defense Engine for Patch Strategy Optimization
arxiv_fulltext·2025-08-01
CyGATE: Game-Theoretic Cyber Attack-Defense Engine for Patch Strategy Optimization
CyGATE: Game-Theoretic Cyber Attack-Defense Engine for Patch Strategy Optimization
Yuning Jiang1,
Nay Oo2,
Qiaoran Meng1,
Lu Lin1,
Dusit Niyato3,
Zehui Xiong4,
Hoon Wei Lim2,
Biplab Sikdar1
1
National University of Singapore, Singapore
2NCS Cyber Special Ops R&D, Singapore
3Nanyang Technological University, Singapore
4Queen's University Belfast, Belfast, UK
## Abstract
Modern cyber attacks unfold through multiple stages, requiring defenders to dynamically prioritize mitigations under uncertainty. While game-theoretic models capture attacker-defender interactions, existing approaches often rely on static assumptions and lack integration with real-time threat intelligence, limiting their adaptability. This paper presents CyGATE, a game-theoretic framework modeling attacker-defender inter
arXiv
CTINexus: Automatic Cyber Threat Intelligence Knowledge Graph Construction Using Large Language Models
arxiv_fulltext·2025-04-21
CTINexus: Automatic Cyber Threat Intelligence Knowledge Graph Construction Using Large Language Models
: Automatic Cyber Threat Intelligence Knowledge Graph Construction Using Large Language Models
Yutong Cheng
Virginia Tech
[email protected]
Osama Bajaber
Virginia Tech
[email protected]
Saimon Amanuel Tsegai
Virginia Tech
[email protected]
Dawn Song
UC Berkeley
[email protected]
Peng Gao
Virginia Tech
[email protected]
## Abstract
Textual descriptions in cyber threat intelligence (CTI) reports, such as security articles and news, are rich sources of knowledge about cyber threats, crucial for organizations to stay informed about the rapidly evolving threat landscape. However, current CTI knowledge extraction methods lack flexibility and generalizability, often resulting in inaccurate and incomplete knowledge extraction. Syntax parsing relies on fixed rules and dictionaries, w
2023-03-14
Published
2023-03-14
Added to CISA KEV
Exploited in the wild