Microsoft has detected a phishing attack targeting government agencies in Europe and North America, using the CVE-2023-36884 vulnerability, conducted by an attacker tracked as Storm-0978. It was determined that these attacks were used for espionage purposes.
Who is the Storm-098 attack group:The attacker, Storm-0978, also known as RomCom , which is the name of their backdoor, is a Russia-based cybercrime group. It is known that this group not only carries out ransomware attacks, but also carries out identity collection attacks to support intelligence operations. This group is also the group that distributed Underground ransomware, which is also closely related to Industrial Spy ransomware, in May 2022 .
How to exploit CVE-2023-36884 vulnerability:It is a vulnerability that allows exploiting a series of remote code execution vulnerabilities affecting Microsoft Windows and Office products. Attackers can perform RCE (Remote Code Execution) attacks by using specially prepared Microsoft Office documents. In order to carry out this attack, the attacker must persuade the victim to open this file on their computer.
A successful attack allows attackers to eliminate the three basic elements of information security: confidentiality, integrity and accessibility, by providing them with the authority to access sensitive information, the ability to disable security measures that protect systems, and the ability to deny access to a system with a security breach.
The countries targeted by Storm-0978 affected primarily government and military organizations in Ukraine, as well as organizations in Europe and North America that may be related to Ukrainian issues.
Customers using Microsoft Defender for Office 365 are protected from attachments that attempt to exploit CVE-2023-36884. Additionally, customers using Microsoft 365 Apps (for versions 2302 and later) are protected from exploits through Office.
What Attackers Did By Taking Advantage of This Vulnerability:
In these attacks, phishing e-mails were created by imitating the Ukrainian World Congress organization, creating malicious documents, and these e-mails were directed to defense and government organizations in Europe and North America, where espionage activities were carried out.
