Info Security Magazine15 Jul 2023
LokiBot Malware Targets Windows Users in Office Document Attacks
Fortinet suggests attackers are leveraging vulnerabilities like CVE-2021-40444 and CVE-2022-30190
Actively exploited vulnerability
CVE-2022-30190: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.
CISA KEV source
14 Jun 2022 added
5 Jul 2022 remediation due
Affected product
Microsoft ยท Windows
Known ransomware use: Known
Required action
Follow the source advisory and validate exposure in your environment.
Apply updates per vendor instructions.
Related Yasna coverage
Recent reporting that mentions CVE-2022-30190.
Bleeping Computer1 Jul 2022
XFiles info-stealing malware adds support for Follina delivery
The XFiles info-stealer malware has added a delivery module that exploits CVE-2022-30190, aka Follina, for dropping the payload on target computers. [...]
Bleeping Computer14 Jun 2022
Russian hackers start targeting Ukraine with Follina exploits
Ukraine's Computer Emergency Response Team (CERT) is warning that the Russian hacking group Sandworm may be exploiting Follina, a remote code execution vulnerability in Microsoft Windows Support Diagnostic Tool (MSDT) currently tracked as CVE-2022-30190. [...]