InfoSecBulletin Cybersecurity for mankind
Microsoft has found a group called Forest Blizzard (also known as STRONTIUM) in Russia using a security vulnerability called CVE-2023-23397 to get into email accounts on Exchange servers without permission. The Polish Cyber Command (DKWOC) is working with Microsoft to stop Forest Blizzard and prevent them from using their tricks.
Keep Microsoft Outlook updated to protect against this threat. Microsoft Defender XDR detects the exploitation and known post-compromise activity of CVE-2023-23397. The only changes to the original blog are the updates in the “Who is Forest Blizzard” section, reflecting our updated attribution, and added links to our product Threat Intelligence reports.
CVE-2025-1268
Patch urgently! Canon Fixes Critical Printer Driver Flaw
Within Minute, RamiGPT To Escalate Privilege Gaining Root Access
Australian fintech database exposed in 27000 records
Over 200 Million Info Leaked Online Allegedly Belonging to X
FBI investigating cyberattack at Oracle, Bloomberg News reports
OpenAI Offering $100K Bounties for Critical Vulns
Splunk Alert User RCE and Data Leak Vulns
CIRT alert Situational Awareness for Eid Holidays
Cyberattack on Malaysian airports: PM rejected $10 million ransom
Micropatches released for Windows zero-day leaking NTLM hashes
Who is Forest Blizzard?
Microsoft tracks a Russian state-sponsored threat group called Forest Blizzard (STRONTIUM). They primarily target government, energy, transportation, and non-governmental organizations in the United States, Europe, and the Middle East. The United States and United Kingdom governments have linked Forest Blizzard to Unit 26165 of the Russian military intelligence agency known as GRU.
Forest Blizzard regularly uses publicly available vulnerabilities in their operations. Specifically, starting from September 2023, they exploited the WinRAR vulnerability (CVE-2023-38831) to conduct spear-phishing attacks primarily targeting Ukrainian government entities. Forest Blizzard has also utilized other known vulnerabilities such as CVE-2021-40444, CVE-2021-42292, CVE-2021-42321, CVE-2021-34473, CVE-2020-17144, and CVE-2020-0688.
ALSO READ:
About 20,000 Microsoft Exchange Servers at Risk of Cyberattacks
Forest Blizzard is a highly skilled and well-equipped group that regularly improves its methods and uses new malware. This makes it difficult to identify and track their activities. Microsoft is constantly updating its defenses against this group based on our research and data. Other researchers have used various names to refer to similar groups, such as GRU Unit 26165, APT28, Sednit, Sofacy, and Fancy Bear.
This guide helps organizations check if their users have been targeted or compromised by hackers who are taking advantage of a vulnerability called CVE-2023-23397. If this vulnerability is successfully exploited, it may allow unauthorized access to an organization’s system by leaking a Net-NTLMv2 hash. Knowing more about the vulnerability and how hackers are using it can help with the investigation process.
This document covers:
An overview of the vulnerability
Exploit scenarios
Post-exploit activities observed in attacks
Techniques for determining if an organization was targeted or compromised via this vulnerability
Mitigations available to protect your environment
CVE-2023-23397 can be difficult to detect using traditional endpoint forensic analysis. However, Microsoft Incident Response (previously known as Microsoft Detection and Response Team – DART) has found a way to detect the exploitation of this vulnerability. This blog explains how they did it and provides guidance for organizations to identify evidence of compromise related to CVE-2023-23397.
This vulnerability causes a leak of the Net-NTLMv2 hash. This leaked hash can be exploited after the initial attack. In this blog post, we focus on specific post-exploitation activities that target Microsoft Exchange Server. However, there are many ways in which a threat actor can use a leaked Net-NTLMv2 hash. To read the full report click here.
