InfoSecBulletin Cybersecurity for mankind
Microsoft has found a group called Forest Blizzard (also known as STRONTIUM) in Russia using a security vulnerability called CVE-2023-23397 to get into email accounts on Exchange servers without permission. The Polish Cyber Command (DKWOC) is working with Microsoft to stop Forest Blizzard and prevent them from using their tricks.
Keep Microsoft Outlook updated to protect against this threat. Microsoft Defender XDR detects the exploitation and known post-compromise activity of CVE-2023-23397. The only changes to the original blog are the updates in the “Who is Forest Blizzard” section, reflecting our updated attribution, and added links to our product Threat Intelligence reports.
Eight New ICS Advisories released by CISA
Authority Denies
Hacker claim ransomware attack on Indonesia’s state bank BRI
London-based company “Builder.ai” reportedly exposed 1.2 TB data
(CVE-2024-12727, CVE-2024-12728, CVE-2024-12729)
Sophos resolved 3 critical vulnerabilities in Firewall
“Workshop on Cybersecurity Awareness and Needs Analysis” held at BBTA
CVE-2023-48788
Kaspersky reveals active exploitation of Fortinet Vulnerability
U.S. Weighs Ban on Chinese-Made Router TP-Link: WSJ reports
Daily Security Update Dated: 18.12.2024
CISA released best practices to secure Microsoft 365 Cloud environments
Data breach! Ireland fines Meta $264 million, Australia $50m
Who is Forest Blizzard?
Microsoft tracks a Russian state-sponsored threat group called Forest Blizzard (STRONTIUM). They primarily target government, energy, transportation, and non-governmental organizations in the United States, Europe, and the Middle East. The United States and United Kingdom governments have linked Forest Blizzard to Unit 26165 of the Russian military intelligence agency known as GRU.
Forest Blizzard regularly uses publicly available vulnerabilities in their operations. Specifically, starting from September 2023, they exploited the WinRAR vulnerability (CVE-2023-38831) to conduct spear-phishing attacks primarily targeting Ukrainian government entities. Forest Blizzard has also utilized other known vulnerabilities such as CVE-2021-40444, CVE-2021-42292, CVE-2021-42321, CVE-2021-34473, CVE-2020-17144, and CVE-2020-0688.
ALSO READ:
About 20,000 Microsoft Exchange Servers at Risk of Cyberattacks
Forest Blizzard is a highly skilled and well-equipped group that regularly improves its methods and uses new malware. This makes it difficult to identify and track their activities. Microsoft is constantly updating its defenses against this group based on our research and data. Other researchers have used various names to refer to similar groups, such as GRU Unit 26165, APT28, Sednit, Sofacy, and Fancy Bear.
This guide helps organizations check if their users have been targeted or compromised by hackers who are taking advantage of a vulnerability called CVE-2023-23397. If this vulnerability is successfully exploited, it may allow unauthorized access to an organization’s system by leaking a Net-NTLMv2 hash. Knowing more about the vulnerability and how hackers are using it can help with the investigation process.
This document covers:
An overview of the vulnerability
Exploit scenarios
Post-exploit activities observed in attacks
Techniques for determining if an organization was targeted or compromised via this vulnerability
Mitigations available to protect your environment
CVE-2023-23397 can be difficult to detect using traditional endpoint forensic analysis. However, Microsoft Incident Response (previously known as Microsoft Detection and Response Team – DART) has found a way to detect the exploitation of this vulnerability. This blog explains how they did it and provides guidance for organizations to identify evidence of compromise related to CVE-2023-23397.
This vulnerability causes a leak of the Net-NTLMv2 hash. This leaked hash can be exploited after the initial attack. In this blog post, we focus on specific post-exploitation activities that target Microsoft Exchange Server. However, there are many ways in which a threat actor can use a leaked Net-NTLMv2 hash. To read the full report click here.
