Zero-Day MS Word Vulnerability "Follina"

This vulnerability was discovered by Nao Sec on May 27, 2022, titled 'Follina' (CVE-2022–30190), targeting Microsoft Office that the new zero-day MS Word vulnerability is being actively exploited. Microsoft's Windows Support Diagnostic Tool (MSDT) flaw allows code to be loaded and executed via PowerShell even when macros are disabled. This exploit takes advantage of this flaw.

By exploiting the CVE, a hacker can run any code they want on the victim's machine. However, an attacker must socially engineer the victim into opening a specially crafted file to exploit this issue, making the vulnerability less obvious to unskilled actors but highly relevant to ransomware gangs such as CONTI and ALPHV. Businesses need to focus on threat prevention to combat this new threat.

Key underground dark web forums catering to ransomware groups and the ransomware-as-a-service model, such as RAMP, have already discussed the CVE's existence. These actors can be found on popular underground forums such as Telegram and Discord and the English-language Breached.

This is how the attack works:

• You open an infected malware DOC file that you got in the mail or downloaded from the internet.
• The document refers to a https: URL that is downloaded.
• This https: URL points to an HTML file containing some strange-looking JavaScript scripts.
• Instead of https: this JavaScript points to a URL with the unusual identifier ms-msdt:
• A specialized URL type on Windows, ms-msdt: is used to launch the MSDT software toolkit.
• MSDT refers to Microsofts Support Diagnostic Tool.
• An untrusted command line is supplied to MSDT via the URL.

Microsoft has assigned Follina a "0 — Exploitation Detected" EI(Exploitability Index) rating, but it has already been exploited. There is a good chance that ransomware developers are scrambling to incorporate the CVE into their toolkit, and some may already be using a working exploit that targets Microsoft Office and relies on social engineering.

Tips for Mitigation

1. The most common way to protect yourself from this vulnerability is to avoid downloading files from untrusted sources.
2. AppLocker exceptions can be used to prevent this vulnerability from being exploited.
3. It's essential to educate your employees about the most common Social Engineering ruses and signs.