Russia-linked APT targets Ukraine by exploiting the Follina RCE vulnerability

Ukraine’s Computer Emergency Response Team (CERT) warns that the Russia-linked Sandworm APT group may exploit the Follina RCE vulnerability.

Ukraine’s Computer Emergency Response Team (CERT) is warning that the Russia-linked Sandworm APT may be exploiting the recently discovered Follina RCE. The issue, tracked as CVE-2022-30190, impacts the Microsoft Windows Support Diagnostic Tool (MSDT).

Nation-state actors are targeting media organizations in Ukraine, including radio stations, and newspapers. The malspam messages use the topic “LIST of links to interactive maps,” according to the CERT-UA, more malicious emails reached more than 500 recipients.

The malspam messages used the weaponized document “LIST_of_links_in_interactive_maps.docx.” Upon opening the document it will load the HTML-file and execute JavaScript code, which, in turn, will download and execute the EXE-file “2.txt”, which is detected as malicious CrescentImp.

“Attackers continue to exploit vulnerability CVE-2022-30190 and are increasingly resorting to emails from compromised government emails.” reads the alert published by the Ukraine CERT.

The government experts tracked the activity as UAC-0113, which is a threat actor that with a medium level of confidence is associated with the Sandworm APT group.

Targeting media orgs

CERT-UA also shared indicators of compromise for these attacks.

Security Affairs is one of the finalists for the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS. I ask you to vote for me again (even if you have already done it), because this vote is for the final.

Please vote for Security Affairs and Pierluigi Paganini in every category that includes them (e.g. sections “The Underdogs – Best Personal (non-commercial) Security Blog” and “The Tech Whizz – Best Technical Blog”)

To nominate, please visit: 

https://docs.google.com/forms/d/e/1FAIpQLSdNDzjvToMSq36YkIHQWwhma90SR0E9rLndflZ3Cu_gVI2Axw/viewform

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, CERT-UA sandworm)

[adrotate banner=”5″]

[adrotate banner=”13″]