Russian state-backed hacking group Forest Blizzard has been using a known Microsoft Outlook vulnerability to target public and private entities in Poland, Polish Cyber Command has warned.
Compromising email accounts and maintaining access to them.
APT28 is known for targeting government, non-governmental, energy and transportation organizations in the US, Europe, and the Middle East.
The most recent attacks were detected and reported by the computer security incident response team of the Polish National Research institute.
The attacks were further analyzed by Polish Cyber Command, who confirmed that the threat actors have been gaining access to email accounts within Microsoft Exchange servers and modifying folder permissions within the victim's mailbox.
APT28 leverages CVE-2023-23397 to spy on organizations in Poland.
CVE-2023-23397 is a critical elevation of privilege vulnerability that affects Microsoft Outlook for Windows.
CVE-2023-23397 can be exploited by sending to the target a specially crafted email message that triggers a reminder.
Even though Microsoft urged users to patch the vulnerability in March, it's obvious that there are systems out there that are still unpatched and vulnerable.
In late March, Microsoft published detailed mitigations, indicators of compromise and methods for determining whether a company has been compromised by attackers exploiting CVE-2023-23397, and that advice still holds.
Polish Cyber Command has provided a toolkit that organizations can use to detect potentially suspicious mailbox folder sharing within Microsoft Exchange servers, and a list of recommendations and guidelines on what to do if compromise is suspected.
They assess that the adversary is sophisticated and has a thorough knowledge of the architecture and mechanisms of the Microsoft Exchange mail system.
The attackers also used commercial VPN services to blend their attack traffic and changed IP addresses when hitting different targets.
This Cyber News was published on www.helpnetsecurity.com. Publication date: Tue, 05 Dec 2023 15:13:05 +0000