Loading story…
Microsoft said Russian state-backed threat actor Forest Blizzard (also tracked as APT28 or STRONTIUM) actively exploited CVE-2023-23397, a critical Outlook for Windows elevation-of-privilege flaw that can leak a victim’s Net-NTLMv2 hash through a specially crafted reminder message without user interaction. The stolen hash can then be used in NTLM relay attacks against Exchange, allowing attackers to access Exchange-hosted mailboxes, move laterally, and establish persistence. Microsoft said exploitation dated back to at least April 2022 and linked the activity to the GRU-associated actor previously tied by U.S. and U.K. authorities to Unit 26165.
Reporting from Microsoft and other security firms tied the campaign to broader Russian espionage operations targeting government, military, energy, transportation, research, and other strategic organizations, with Unit 42 saying at least 30 organizations in 14 countries were affected over roughly 20 months, many in NATO states. Investigators observed attackers abusing Exchange Web Services and modifying mailbox folder permissions to retain unauthorized access to mailbox contents, a technique also highlighted by Polish authorities. Microsoft urged defenders to patch Outlook, apply Exchange security updates, block outbound SMB on TCP 445, and reduce or disable NTLM exposure; it also noted that Exchange Online and updated Exchange Server builds can strip the malicious PidLidReminderFileParameter used in the attack chain.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
By December 2023, Microsoft, ANSSI, Recorded Future, Proofpoint, and Palo Alto Networks Unit 42 had linked the CVE-2023-23397 activity to broader Russian state-sponsored campaigns targeting government, military, energy, transportation, research, and other strategic organizations. Unit 42 said the campaign affected at least 30 organizations in 14 countries over roughly 20 months, mostly in NATO member states.
On March 24, 2023, Microsoft publicly detailed active exploitation of CVE-2023-23397, attributed the activity to Forest Blizzard/STRONTIUM, and released hunting guidance, indicators, and mitigation recommendations. Microsoft said the actor used the flaw to access Exchange environments, move laterally, and abuse NTLM relay and Exchange Web Services.
Microsoft patched the critical Outlook for Windows elevation-of-privilege vulnerability CVE-2023-23397 in March 2023. The update prevents Outlook from honoring untrusted remote paths used in the attack chain.
During the exploitation campaign, Forest Blizzard used stolen credentials and Exchange access to modify mailbox folder permissions and maintain persistent unauthorized access to mailbox contents. Polish authorities later highlighted this technique as part of the activity.
Microsoft said evidence of exploitation of the Outlook vulnerability CVE-2023-23397 dates back to April 2022. The flaw allowed specially crafted reminder messages to leak Net-NTLMv2 hashes without user interaction.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcetechtarget.com
Open sourcemicrosoft.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**APT28** (Russia-linked) has been observed exploiting a **Microsoft Office RTF zero-day, `CVE-2026-21509`**, in a campaign dubbed **Operation Neusploit** targeting organizations in **Central and Eastern Europe** (including **Ukraine, Slovakia, and Romania**). The intrusion chain begins with **socially engineered emails** delivering **weaponized RTF documents**; opening the file triggers code execution and downloads a malicious **dropper DLL** from attacker-controlled infrastructure, enabling follow-on payload deployment and persistence. Technical analysis describes **two dropper variants** that deploy different components, including **MiniDoor**, a malicious **Microsoft Outlook VBA** project designed to **steal and forward emails**. Observed behaviors include writing the VBA payload to `%appdata%\Microsoft\Outlook\VbaProject.OTM`, creating a mutex (`adjgfenkbe`), and modifying Windows Registry settings to **weaken Outlook security** so the malicious project loads automatically at Outlook startup; string decryption uses XOR routines (including a hardcoded `0x3a` key and a rolling XOR key). Reporting attributes the activity to APT28 based on TTP overlaps and notes exploitation was seen **in the wild** shortly after Microsoft issued an emergency fix.
Jun 29, 2026
Attackers exploited multiple zero-day and later related vulnerabilities in on-premises Microsoft Exchange Server to compromise email systems at tens of thousands of organizations worldwide, including government agencies, banks, universities, defense contractors, law firms, healthcare entities, local governments, and small businesses. Microsoft initially attributed the early activity to the China-linked group **Hafnium**, while CISA, the FBI, and the White House warned that exploitation quickly spread to many additional state-backed and criminal actors after patches were released. The intrusions affected Exchange 2010, 2013, 2016, and 2019 deployments rather than Exchange Online or Microsoft 365, and enabled attackers to steal emails and address books, dump credentials, install **web shells** such as **China Chopper**, move laterally, and in some cases deploy follow-on malware including ransomware. U.S. and allied governments later formally attributed the campaign to actors affiliated with China’s Ministry of State Security, as CISA said organizations should investigate for compromise dating back to at least January 2021 and assume identity compromise where exploitation was found. Security researchers and incident responders reported thousands of backdoored servers across more than 100 countries, with many systems still unpatched well after disclosure, and warned that patching alone did not remove implanted persistence. Microsoft and CISA released emergency updates, detection and remediation guidance, and tools including `Test-ProxyLogon.ps1` and `EOMT.ps1`, while later research showed Exchange attack chains such as **ProxyShell** could still be adapted for remote code execution and could evade weak perimeter defenses, reinforcing that rapid patching and thorough incident response were essential.
Jun 29, 2026
Microsoft released fixes for **CVE-2026-42897**, a high-severity spoofing flaw in **Exchange Server** that was actively exploited in attacks and could lead to arbitrary JavaScript execution through cross-site scripting in **Outlook Web Access (OWA)**. The vulnerability affects **Exchange Server 2016**, **Exchange Server 2019**, and **Exchange Server Subscription Edition**, and can be triggered remotely without privileges by sending a specially crafted email that executes when opened in OWA under certain user-interaction conditions. Microsoft classifies the issue as a spoofing vulnerability, consistent with prior MSHTML- and web-rendering-related spoofing flaws such as **CVE-2024-43461**. Before full patches were released, Microsoft deployed an automatic temporary mitigation through the **Exchange Emergency Mitigation Service** in mid-May and later shipped permanent fixes in its June 2026 security updates, while advising administrators to keep mitigations enabled and patch immediately. **CISA** added the bug to its **Known Exploited Vulnerabilities** catalog on May 15 and ordered U.S. federal agencies to remediate affected systems by May 29, underscoring continued attacker focus on Exchange, which has seen numerous exploited flaws over the past five years, including several linked to ransomware activity.
Jun 29, 2026