InfoSecBulletin Cybersecurity for mankind
Microsoft has found a group called Forest Blizzard (also known as STRONTIUM) in Russia using a security vulnerability called CVE-2023-23397 to get into email accounts on Exchange servers without permission. The Polish Cyber Command (DKWOC) is working with Microsoft to stop Forest Blizzard and prevent them from using their tricks.
Keep Microsoft Outlook updated to protect against this threat. Microsoft Defender XDR detects the exploitation and known post-compromise activity of CVE-2023-23397. The only changes to the original blog are the updates in the “Who is Forest Blizzard” section, reflecting our updated attribution, and added links to our product Threat Intelligence reports.
Ransomware hit Bangladeshi Globe Pharmaceuticals Ltd
Joint cybersecurity advisory
Botnet infects 260,000 SOHO routers, IP cameras with malware
Chrome 129 Released Fix with multiple Security Flaws
Broadcom fixed RCE bug in VMware vCenter Server
Cybercriminal now misuse Microsoft Azure tool to steal data
Apple warns users to install iOS 18 to Fix 33 iPhone Vulnerabilities
CISA adds windows and whatsUp Gold vuls to its KEV
Petroleum and Fuel Industry
FleetPanda exposes Nearly One Million Documents
DESCO faces cyber attack: Customers Data Breach
Alert! Google Fixes GCP Composer Flaw
Who is Forest Blizzard?
Microsoft tracks a Russian state-sponsored threat group called Forest Blizzard (STRONTIUM). They primarily target government, energy, transportation, and non-governmental organizations in the United States, Europe, and the Middle East. The United States and United Kingdom governments have linked Forest Blizzard to Unit 26165 of the Russian military intelligence agency known as GRU.
Forest Blizzard regularly uses publicly available vulnerabilities in their operations. Specifically, starting from September 2023, they exploited the WinRAR vulnerability (CVE-2023-38831) to conduct spear-phishing attacks primarily targeting Ukrainian government entities. Forest Blizzard has also utilized other known vulnerabilities such as CVE-2021-40444, CVE-2021-42292, CVE-2021-42321, CVE-2021-34473, CVE-2020-17144, and CVE-2020-0688.
ALSO READ:
About 20,000 Microsoft Exchange Servers at Risk of Cyberattacks
Forest Blizzard is a highly skilled and well-equipped group that regularly improves its methods and uses new malware. This makes it difficult to identify and track their activities. Microsoft is constantly updating its defenses against this group based on our research and data. Other researchers have used various names to refer to similar groups, such as GRU Unit 26165, APT28, Sednit, Sofacy, and Fancy Bear.
This guide helps organizations check if their users have been targeted or compromised by hackers who are taking advantage of a vulnerability called CVE-2023-23397. If this vulnerability is successfully exploited, it may allow unauthorized access to an organization’s system by leaking a Net-NTLMv2 hash. Knowing more about the vulnerability and how hackers are using it can help with the investigation process.
This document covers:
An overview of the vulnerability
Exploit scenarios
Post-exploit activities observed in attacks
Techniques for determining if an organization was targeted or compromised via this vulnerability
Mitigations available to protect your environment
CVE-2023-23397 can be difficult to detect using traditional endpoint forensic analysis. However, Microsoft Incident Response (previously known as Microsoft Detection and Response Team – DART) has found a way to detect the exploitation of this vulnerability. This blog explains how they did it and provides guidance for organizations to identify evidence of compromise related to CVE-2023-23397.
This vulnerability causes a leak of the Net-NTLMv2 hash. This leaked hash can be exploited after the initial attack. In this blog post, we focus on specific post-exploitation activities that target Microsoft Exchange Server. However, there are many ways in which a threat actor can use a leaked Net-NTLMv2 hash. To read the full report click here.
