Loading story…
Attackers have been exploiting the Windows MSDT Follina vulnerability to compromise systems and deliver follow-on malware, including remote access trojans and information stealers. Reporting from Symantec said the flaw was used as an initial access vector that enabled attackers to execute code through malicious documents and establish broader footholds on victim networks.
SecurityScorecard separately linked suspected exploitation of Follina to a ransomware incident affecting a major U.S. public housing authority that was later claimed by LockBit. Investigators found network traffic between the authority and infrastructure previously tied to malicious activity and earlier ransomware victims, likely use of remote access software, and large outbound transfers to suspicious DigitalOcean and Rackspace IP addresses that may indicate data exfiltration before the organization appeared on LockBit’s leak site.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Local media reported on January 3 that a major U.S. city’s housing authority had suffered a ransomware attack. The housing authority acknowledged technical difficulties and warned of possible service disruptions, but did not publicly confirm LockBit’s claims.
On January 2, the LockBit ransomware group claimed responsibility for the incident by listing the housing authority on its data leak site. LockBit also claimed it had exfiltrated 15 TB of data from the organization’s systems.
SecurityScorecard observed a housing authority IP address communicating 5,904 times with 159.65.216[.]150 between November 2 and December 30, and another housing authority IP communicating 2,896 times with 173.199.15[.]254 between November 2 and January 2. The report linked these IPs to prior malicious activity, previous ransomware victims, and possible attacker remote access.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
securityscorecard.com
Open sourcesymantec-enterprise-blogs.security.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed **CVE-2022-30190** ("**Follina**"), a remote code execution flaw in the Windows **Microsoft Support Diagnostic Tool** (**MSDT**) that could be triggered through the `ms-msdt` URL protocol from applications such as Microsoft Word. A successful exploit allowed arbitrary code execution with the privileges of the calling application, enabling attackers to install programs, alter or delete data, and create accounts within the victim’s user context. Microsoft later issued security updates and a defense-in-depth fix through cumulative updates, while also advising customers on protections for older Windows versions. Technical analysis showed attackers used malicious **DOC**, **DOCX**, and **RTF** files to fetch remote HTML that invoked `ms-msdt` and launched attacker-controlled PowerShell, with some **RTF** attacks requiring only the Windows preview pane to trigger. Observed exploit chains involved processes including `WINWORD.EXE`, `msdt.exe`, and `sdiagnhost.exe`, and were used to download follow-on payloads, steal data, and stage malware. Microsoft and independent researchers recommended disabling the MSDT URL protocol as a workaround until patching, and highlighted Defender detections, Microsoft 365 Defender alerting, YARA opportunities, and forensic artifacts such as `PCW.debugreport.xml` to help defenders identify exploitation attempts.
Sep 3, 2026
Fortinet researchers reported a phishing campaign exploiting the Microsoft Support Diagnostic Tool flaw **Follina** (`CVE-2022-30190`) to infect Windows systems with the **Rozena** backdoor. The attack used a weaponized Microsoft Office document that fetched remote HTML content from a Discord CDN URL, abused `msdt.exe` to launch PowerShell, and downloaded additional payloads without requiring macros, ultimately placing the malware as `Word.exe` in the Windows Tasks folder. Once executed, Rozena injected shellcode and opened a reverse shell to `microsofto.duckdns[.]org`, giving the attacker remote control of the compromised host. The reporting said Microsoft had already issued a patch for `CVE-2022-30190`, while the campaign analysis also provided file hashes and detection guidance for defenders to identify malicious documents, payload retrieval, and follow-on activity tied to the intrusion.
Aug 15, 2026
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026