Loading story…
Attackers exploited CVE-2023-23397, a Microsoft Outlook elevation-of-privilege flaw, by sending specially crafted messages that triggered Outlook to authenticate automatically to attacker-controlled servers without user interaction. The vulnerability exposed NTLM credential hashes and was used in the wild against government, military, energy, and transportation organizations in Europe, with Microsoft attributing observed activity to a Russia-based threat actor. Research also showed that real attacks used Outlook task messages in addition to the appointment-based technique highlighted in early proof-of-concept reporting.
Microsoft released a patch and published remediation guidance for Exchange administrators, including a PowerShell tool to identify and clean up malicious items tied to the vulnerable property. The CVE-2023-23397.ps1 script supports audit and cleanup modes across Exchange Server and Exchange Online, producing CSV results and allowing administrators to clear the property or delete flagged items. Operational guidance covers required roles, impersonation and authentication setup, and troubleshooting for large mailbox environments, underscoring the need to patch Outlook clients and retroactively hunt for malicious messages in mailboxes.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
Microsoft issued a patch for the Outlook elevation-of-privilege vulnerability CVE-2023-23397 after CERT-UA reported the issue. The flaw allowed specially crafted emails to coerce NTLM authentication to attacker-controlled servers.
MDSec previously demonstrated a proof of concept for exploiting CVE-2023-23397 using an Outlook appointment message. This established public technical details for the attack path before broader reporting on in-the-wild abuse.
Microsoft Threat Intelligence assessed that a Russia-based threat actor exploited CVE-2023-23397 against government, military, energy, and transportation organizations in Europe. The observed activity occurred between April 2022 and December 2022.
Unit 42 reported that Iranian-linked xHunt activity in 2020 used Outlook reminder UNC paths to harvest NTLM credentials, a technique later noted as relevant to CVE-2023-23397-style abuse.
Deep Instinct Threat Lab reported finding additional malicious samples exploiting CVE-2023-23397 and grouped them into five clusters. It also observed that real-world attacks used Outlook task messages rather than only appointment messages shown in prior proof-of-concept work.
Microsoft made available a PowerShell script to help administrators retroactively search Exchange environments for potentially malicious Outlook messages exploiting CVE-2023-23397. The script supports auditing and cleanup of mail, calendar, and task items.
Deep Instinct said it found extracts from malicious emails sent to Polish targets that were dated to September and were not returned by the cited VirusTotal query. The finding added evidence of in-the-wild exploitation artifacts.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
microsoft.github.io
Open sourcedeepinstinct.com
Open sourceunit42.paloaltonetworks.com
Open sourcemdsec.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft said Russian state-backed threat actor **Forest Blizzard** (also tracked as **APT28** or **STRONTIUM**) actively exploited **`CVE-2023-23397`**, a critical Outlook for Windows elevation-of-privilege flaw that can leak a victim’s **Net-NTLMv2** hash through a specially crafted reminder message **without user interaction**. The stolen hash can then be used in **NTLM relay** attacks against Exchange, allowing attackers to access Exchange-hosted mailboxes, move laterally, and establish persistence. Microsoft said exploitation dated back to at least April 2022 and linked the activity to the GRU-associated actor previously tied by U.S. and U.K. authorities to **Unit 26165**. Reporting from Microsoft and other security firms tied the campaign to broader Russian espionage operations targeting government, military, energy, transportation, research, and other strategic organizations, with Unit 42 saying at least **30 organizations in 14 countries** were affected over roughly 20 months, many in NATO states. Investigators observed attackers abusing **Exchange Web Services** and modifying mailbox folder permissions to retain unauthorized access to mailbox contents, a technique also highlighted by Polish authorities. Microsoft urged defenders to patch Outlook, apply Exchange security updates, block outbound **SMB** on TCP 445, and reduce or disable NTLM exposure; it also noted that **Exchange Online** and updated Exchange Server builds can strip the malicious `PidLidReminderFileParameter` used in the attack chain.
Aug 14, 2026
Microsoft's `CVE-2023-23397` is an Outlook for Windows elevation-of-privilege flaw that can be exploited to coerce a victim's system into leaking NTLM credentials, prompting defenders to prioritize Microsoft's security update and related mitigations. SecurityScorecard reported that the vulnerability affects all supported Outlook for Windows versions and highlighted the risk of credential theft through malicious messages that trigger outbound authentication without user interaction. SecurityScorecard said it observed 2,581 data transfers between January 15 and March 15 involving two IP addresses believed to be tied to a Ukrainian local government entity and a Ukrainian bank, including suspicious SMB traffic over TCP `445` and multiple large transfers that could indicate exfiltration. Several external IPs contacting the possible targets had VirusTotal detections or had appeared in earlier ransomware and data-theft investigations, although the report noted prior public research linked exploitation of `CVE-2023-23397` to a nation-state espionage actor and warned that any infrastructure overlap does not necessarily mean the same operators were involved.
Aug 21, 2026
Microsoft patched multiple actively exploited vulnerabilities across Windows, Outlook, Office, and Exchange Server, including the Outlook flaw **CVE-2024-21413** and the Exchange Server issue **CVE-2024-21410**. The February Patch Tuesday release addressed 73 vulnerabilities in total, with five rated critical, and included fixes for additional zero-days such as **CVE-2024-21412** involving Internet Shortcut/LNK files and **CVE-2024-21351**, a security feature bypass used in attacks. The Outlook vulnerability **CVE-2024-21413** stems from improper parsing of `file://` links, allowing attackers to bypass Protected View, leak NTLM credentials, and potentially achieve remote code execution. In Exchange Server, **CVE-2024-21410** allows an unauthenticated attacker to capture and relay Net-NTLMv2 authentication material; defenders were urged to apply Microsoft’s security updates immediately and enable **Extended Protection for Authentication** on Exchange systems.
Jul 24, 2026