Loading story…
Attackers exploited CVE-2023-36884, a Microsoft Office and Windows HTML remote code execution zero-day, in attacks involving RomCom malware. Microsoft disclosed the vulnerability, rated Important, during its July 2023 Patch Tuesday release, while Unit 42 confirmed exploitation dating to at least July 3. Observed attacks required victims to open specially crafted Office documents; the documented attack chain downloaded a script that initiated iframe injection and retrieved a malicious payload.
Microsoft subsequently released an Office security update that interrupts the attack chain, with related guidance published under ADV230003. Organizations should prioritize deploying the Office update. Where patching is not immediately possible, Microsoft recommended blocking Office applications from creating child processes or configuring the FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION setting to mitigate exposure.
See which actors are running it and whether you're in range.
8 events from the most recent confirmed update back to the earliest known activity.
Trellix published analysis showing how Storm-0978's Office documents embedded malicious RTF through AltChunk, triggering linked OLE retrieval and redirects leading to Windows .search-ms files and remote code execution. Researchers also demonstrated reconstruction of the document structure and published infection-chain indicators.
Microsoft reported that early exploitation of CVE-2023-36884 involved RomCom malware, which had previously appeared in ransomware and targeted espionage-related attacks.
Unit 42 confirmed exploitation dating to at least July 3, 2023. The observed attacks required users to open specially crafted Microsoft Office documents.
During its July 2023 Patch Tuesday release, Microsoft disclosed CVE-2023-36884, an Important-severity remote code execution vulnerability affecting Office and Windows HTML. Microsoft recommended blocking Office child processes or configuring FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION as interim mitigations.
Unit 42 first observed RomCom, a remote access Trojan later associated with early exploitation of CVE-2023-36884.
Unit 42's investigation uncovered a separate Mark-of-the-Web bypass that Microsoft designated CVE-2023-36584 and rewarded with a bug bounty. Researchers demonstrated three bypass techniques involving ZIP metadata inconsistencies or delayed SMB responses, but did not confirm attackers used the ZIP-swap technique.
Microsoft released an Office patch that stops the documented attack chain leading to exploitation of CVE-2023-36884. Unit 42 updated its brief on August 9, 2023, to include the released patch and recommended applying it.
Unit 42 documented how opening a malicious document downloads a script that initiates iframe injection and retrieves a malicious payload. Its threat brief listed file hashes, IP addresses and domains, and reported sharing findings, samples and indicators with Cyber Threat Alliance members.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 45 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
trellix.com
Open sourceunit42.paloaltonetworks.com
Open sourceunit42.paloaltonetworks.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET reported that the Russia-aligned **RomCom** group actively exploited the WinRAR zero-day **`CVE-2025-8088`**, a path traversal flaw involving Windows Alternate Data Streams that let malicious archives appear harmless while dropping files during extraction. The attacks used spearphishing emails with **CV/resume-themed RAR attachments** to target organizations in finance, manufacturing, defense, and logistics across Europe and Canada, and the exploitation chain deployed RomCom-associated tooling including a **Mythic** agent, a **SnipBot** variant, and **RustyClaw/MeltingClaw** downloaders. ESET said the flaw was fixed in **WinRAR 7.13**, warned that other actors also began exploiting it, and urged updates for WinRAR and downstream **UnRAR.dll** consumers. Separate reporting from Trend Micro described 2025 intrusion campaigns tracked as **SHADOW-VOID-042** that showed overlap with activity previously attributed to **Void Rabisu/ROMCOM**, though attribution remained unconfirmed. Those operations used tailored social-engineering lures aimed at executives and HR staff, and later impersonated Trend Micro browser security and Apex One updates against Trend Micro, a subsidiary, a partner, and other organizations. Recovered components showed a multi-stage chain using a Cloudflare-themed landing page, JavaScript exploiting **`CVE-2018-6065`**, delivery of an encrypted binary to `C:\ProgramData\Microsoft\Windows\SystemProcessHost.exe`, and persistence through a scheduled task running as **SYSTEM**; Trend Micro said early disruption prevented recovery of the final payload.
Aug 21, 2026
Microsoft disclosed that the Russia-linked threat actor **Storm-0978** used malicious Microsoft Word documents to exploit **`CVE-2023-36884`**, a remote code execution flaw in the Windows HTML component, in spear-phishing campaigns against government, defense, and other organizations in Europe and North America. The lures referenced Ukrainian political affairs and groups such as the Ukrainian World Congress, and the activity was tied to delivery of a backdoor with similarities to **RomCom**, alongside credential theft and follow-on intrusion activity. Microsoft assessed the actor as pursuing both **financially motivated ransomware and extortion** operations and separate **espionage-oriented** campaigns, with links to RomCom distribution and ransomware families including Industrial Spy and Underground. The vulnerability affected multiple Windows, Windows Server, and Microsoft Office versions, and Microsoft issued security updates for **`CVE-2023-36884`** while urging organizations to patch immediately, use Microsoft Defender protections, block child process creation from Office applications, and apply the registry-based mitigation **`FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION`** where patching or newer protections were not available.
Aug 6, 2026
Bridewell identified **Operation Deceptive Prospect**, a phishing campaign targeting two UK organisations in retail/hospitality and critical national infrastructure through customer feedback portals. Discovered in March 2025, the campaign used complaint and recruitment lures to direct customer service staff through cloud-storage impersonation domains and multiple redirects to a Windows executable disguised as a PDF. The executable carried a likely stolen or compromised signing certificate. Researchers identified 97 potentially associated first-stage domains, dedicated payload-hosting infrastructure and related executable samples. Bridewell assessed significant technical overlap with RomCom with high confidence, but its malware analysis did not independently establish definitive attribution. Sandbox testing showed no overt malicious activity; suspected anti-sandbox checks and broader geographic targeting remained unconfirmed. The campaign follows ESET’s discovery of a separate RomCom operation chaining **CVE-2024-9680**, a use-after-free vulnerability affecting Firefox, Thunderbird and Tor Browser, with **CVE-2024-49039**, a Windows privilege-escalation flaw. That chain allowed attackers to install the RomCom backdoor without further user interaction after victims reached malicious web infrastructure. The Russia-aligned group targeted sectors including government, defense, energy and legal services, with capabilities supporting data theft, credential harvesting, lateral movement and persistence. Mozilla and Microsoft issued fixes following coordinated disclosure. Organisations should verify deployment of those patches, scrutinise links submitted through public-facing customer portals, and avoid treating a valid digital signature as proof that a downloaded file is safe.
Oct 9, 2026