InfoSecBulletin Cybersecurity for mankind
Microsoft has found a group called Forest Blizzard (also known as STRONTIUM) in Russia using a security vulnerability called CVE-2023-23397 to get into email accounts on Exchange servers without permission. The Polish Cyber Command (DKWOC) is working with Microsoft to stop Forest Blizzard and prevent them from using their tricks.
Keep Microsoft Outlook updated to protect against this threat. Microsoft Defender XDR detects the exploitation and known post-compromise activity of CVE-2023-23397. The only changes to the original blog are the updates in the “Who is Forest Blizzard” section, reflecting our updated attribution, and added links to our product Threat Intelligence reports.
Samsung phone is saving your passwords in plain text
UK Software Firm Exposed 8 million of Healthcare Worker Records
GitHub Enterprise Server Vulns Expose Risk of Code Execution
CVE-2025-2492
ASUS warns of critical auth bypass flaw in routers
16,000+ Fortinet devices compromised with symlink backdoor, Mostly in Asia
Patch now! Critical Erlang/OTP SSH Vuln Allows UCE
CISA warns of increasing risk tied to Oracle legacy Cloud leak
CVE-2025-20236
Cisco Patches Unauthenticated RCE Flaw in Webex App
Apple released emergency security updates for 2 zero-day vulns
Oracle Released Patched for 378 flaws for April 2025
Who is Forest Blizzard?
Microsoft tracks a Russian state-sponsored threat group called Forest Blizzard (STRONTIUM). They primarily target government, energy, transportation, and non-governmental organizations in the United States, Europe, and the Middle East. The United States and United Kingdom governments have linked Forest Blizzard to Unit 26165 of the Russian military intelligence agency known as GRU.
Forest Blizzard regularly uses publicly available vulnerabilities in their operations. Specifically, starting from September 2023, they exploited the WinRAR vulnerability (CVE-2023-38831) to conduct spear-phishing attacks primarily targeting Ukrainian government entities. Forest Blizzard has also utilized other known vulnerabilities such as CVE-2021-40444, CVE-2021-42292, CVE-2021-42321, CVE-2021-34473, CVE-2020-17144, and CVE-2020-0688.
ALSO READ:
About 20,000 Microsoft Exchange Servers at Risk of Cyberattacks
Forest Blizzard is a highly skilled and well-equipped group that regularly improves its methods and uses new malware. This makes it difficult to identify and track their activities. Microsoft is constantly updating its defenses against this group based on our research and data. Other researchers have used various names to refer to similar groups, such as GRU Unit 26165, APT28, Sednit, Sofacy, and Fancy Bear.
This guide helps organizations check if their users have been targeted or compromised by hackers who are taking advantage of a vulnerability called CVE-2023-23397. If this vulnerability is successfully exploited, it may allow unauthorized access to an organization’s system by leaking a Net-NTLMv2 hash. Knowing more about the vulnerability and how hackers are using it can help with the investigation process.
This document covers:
An overview of the vulnerability
Exploit scenarios
Post-exploit activities observed in attacks
Techniques for determining if an organization was targeted or compromised via this vulnerability
Mitigations available to protect your environment
CVE-2023-23397 can be difficult to detect using traditional endpoint forensic analysis. However, Microsoft Incident Response (previously known as Microsoft Detection and Response Team – DART) has found a way to detect the exploitation of this vulnerability. This blog explains how they did it and provides guidance for organizations to identify evidence of compromise related to CVE-2023-23397.
This vulnerability causes a leak of the Net-NTLMv2 hash. This leaked hash can be exploited after the initial attack. In this blog post, we focus on specific post-exploitation activities that target Microsoft Exchange Server. However, there are many ways in which a threat actor can use a leaked Net-NTLMv2 hash. To read the full report click here.
