Loading story…
Microsoft's CVE-2023-23397 is an Outlook for Windows elevation-of-privilege flaw that can be exploited to coerce a victim's system into leaking NTLM credentials, prompting defenders to prioritize Microsoft's security update and related mitigations. SecurityScorecard reported that the vulnerability affects all supported Outlook for Windows versions and highlighted the risk of credential theft through malicious messages that trigger outbound authentication without user interaction.
SecurityScorecard said it observed 2,581 data transfers between January 15 and March 15 involving two IP addresses believed to be tied to a Ukrainian local government entity and a Ukrainian bank, including suspicious SMB traffic over TCP 445 and multiple large transfers that could indicate exfiltration. Several external IPs contacting the possible targets had VirusTotal detections or had appeared in earlier ransomware and data-theft investigations, although the report noted prior public research linked exploitation of CVE-2023-23397 to a nation-state espionage actor and warned that any infrastructure overlap does not necessarily mean the same operators were involved.
Get the actors, campaigns, and ATT&CK mapping behind it.
8 events from the most recent confirmed update back to the earliest known activity.
SecurityScorecard published research describing suspicious SMB traffic and large data transfers involving two IP addresses linked to a Ukrainian local government entity and a Ukrainian bank in the context of CVE-2023-23397. The report noted overlaps with infrastructure previously tied to ransomware and data-theft investigations, while cautioning that available research had linked exploitation of the flaw to a nation-state espionage actor rather than financially motivated groups.
SecurityScorecard's traffic sample concluded on March 15 after capturing 2,581 data transfers involving the two possible target IP addresses. The researchers also identified 268 transfers of 1 MB or more involving 56 unique IP addresses for closer review as possible exfiltration activity.
A third external IP address was observed contacting TCP port 445 of one possible target IP address on February 26. This added to the set of suspicious SMB connections identified during the monitoring period.
One of the possibly malicious IP addresses that contacted the first target also communicated with the second possible target IP address on February 25. SecurityScorecard highlighted this as part of the suspicious traffic pattern around possible CVE-2023-23397 exploitation.
A second suspicious contact to TCP port 445 of one possible target IP address was observed on February 22. Two of the three IPs seen making such contacts had vendor detections in VirusTotal.
One of three external IP addresses observed contacting TCP port 445 of a possible target IP address did so on January 31 during SecurityScorecard's monitoring period. Researchers flagged port 445 traffic because Microsoft had advised defenders to watch for SMB-related exploitation activity.
SecurityScorecard researchers began a traffic collection period focused on two IP addresses associated with a Ukrainian local government entity and a Ukrainian bank after assessing they may have been likely targets of activity exploiting CVE-2023-23397.
Microsoft published security guidance for CVE-2023-23397, an elevation-of-privilege vulnerability affecting Outlook for Windows. The guidance noted that an update was available and recommended mitigations including avoiding NTLM and blocking outbound SMB traffic on TCP port 445.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 20 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
securityscorecard.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited **CVE-2023-23397**, a Microsoft Outlook elevation-of-privilege flaw, by sending specially crafted messages that triggered Outlook to authenticate automatically to attacker-controlled servers without user interaction. The vulnerability exposed **NTLM credential hashes** and was used in the wild against government, military, energy, and transportation organizations in Europe, with Microsoft attributing observed activity to a Russia-based threat actor. Research also showed that real attacks used Outlook **task** messages in addition to the appointment-based technique highlighted in early proof-of-concept reporting. Microsoft released a patch and published remediation guidance for Exchange administrators, including a PowerShell tool to identify and clean up malicious items tied to the vulnerable property. The `CVE-2023-23397.ps1` script supports audit and cleanup modes across **Exchange Server** and **Exchange Online**, producing CSV results and allowing administrators to clear the property or delete flagged items. Operational guidance covers required roles, impersonation and authentication setup, and troubleshooting for large mailbox environments, underscoring the need to patch Outlook clients and retroactively hunt for malicious messages in mailboxes.
Aug 15, 2026Microsoft said Russian state-backed threat actor **Forest Blizzard** (also tracked as **APT28** or **STRONTIUM**) actively exploited **`CVE-2023-23397`**, a critical Outlook for Windows elevation-of-privilege flaw that can leak a victim’s **Net-NTLMv2** hash through a specially crafted reminder message **without user interaction**. The stolen hash can then be used in **NTLM relay** attacks against Exchange, allowing attackers to access Exchange-hosted mailboxes, move laterally, and establish persistence. Microsoft said exploitation dated back to at least April 2022 and linked the activity to the GRU-associated actor previously tied by U.S. and U.K. authorities to **Unit 26165**. Reporting from Microsoft and other security firms tied the campaign to broader Russian espionage operations targeting government, military, energy, transportation, research, and other strategic organizations, with Unit 42 saying at least **30 organizations in 14 countries** were affected over roughly 20 months, many in NATO states. Investigators observed attackers abusing **Exchange Web Services** and modifying mailbox folder permissions to retain unauthorized access to mailbox contents, a technique also highlighted by Polish authorities. Microsoft urged defenders to patch Outlook, apply Exchange security updates, block outbound **SMB** on TCP 445, and reduce or disable NTLM exposure; it also noted that **Exchange Online** and updated Exchange Server builds can strip the malicious `PidLidReminderFileParameter` used in the attack chain.
Aug 14, 2026
Microsoft disclosed **CVE-2024-38200**, a vulnerability in **Microsoft Office 2016**, **Office 2019**, **Office LTSC 2021**, and **Microsoft 365 Apps** that can let a remote, unauthenticated attacker exfiltrate **NTLM** hashes used for authentication. The issue requires user interaction, such as opening a specially crafted file or clicking a malicious URL, and was assigned a **CVSS 7.5** severity score. Researchers from **PrivSec Consulting** identified the flaw and planned to present additional details at **DEF CON**. Microsoft said mitigations were rolled out through **Feature Flighting** for supported Office and Microsoft 365 versions and urged customers to install the August security updates. The company also recommended hardening steps to reduce NTLM exposure, including using the **Protected Users** security group in Windows Server to limit legacy authentication protections, blocking outbound NTLM communication where possible, and restricting outbound **TCP 445/SMB** traffic to prevent credential leakage.
Jul 24, 2026