{"uuid": "195d040d-7c19-47e1-bc13-6b5c42b668ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-23397", "type": "exploited", "source": "https://t.me/hacking_Attack/94619", "content": "Black Hat Ethical Hacking\nRussian hackers exploit Outlook zero-day vulnerability to target European organizations\n\nRussian hackers exploit Outlook zero-day vulnerability to target European organizationsPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Microsoft patches Outlook zero-day vulnerability used in attacks by Russian hackersMicrosoft has released a security patch to address a critical vulnerability (CVE-2023-23397) in Outlook that was exploited by a Russian hacking group to target government, military, energy, and transportation organizations in Europe. The group, which has been tracked as APT28, Sednit, and Fancy Bear, used malicious Outlook notes and tasks to steal NTLM hashes, which were then used to access victims\u2019 networks and exfiltrate specific accounts.\n\nThe vulnerability can be exploited through low-complexity attacks by sending messages containing UNC paths to attacker-controlled SMB shares. Microsoft recommends immediate patching or temporary mitigation by adding users to the Protected Users group in Active Directory and blocking outbound SMB.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Outlook versions affectedAccording to Microsoft, the vulnerability affects all supported versions of Outlook for Windows but not Outlook for Android, iOS, or macOS versions. Online services like Outlook on the web and Microsoft 365 do not support NTLM authentication, making them immune to attacks exploiting this NTLM relay vulnerability.\nTo help admins check if any users in their Exchange environment have been targeted using this Outlook vulnerability, Microsoft released a dedicated PowerShell script that checks Exchange messaging items for malicious UNC paths and allows modifying or deleting potentially malicious messages if they are found on the audited Exchange Server when run in Cleanup mode.\n\nThis critical elevation of privilege security flaw was first reported by the Computer Emergency Response Team for Ukraine (CERT-UA). Microsoft shared this information in a private threat analytics report available to customers with Microsoft 365 Defender, Microsoft Defender for Business, or Microsoft Defender for Endpoint Plan 2 subscriptions.\nTrending: Major Cyber Attacks of 2022\nTrending: Offensive Security Tool: CrackQL MitigationIn addition to patching, Microsoft advises adding users to the Protected Users group in Active Directory and blocking outbound SMB to limit the impact of the attacks.\n\nMicrosoft urges its customers to take immediate action and patch their systems against CVE-2023-23397 or add users to the Protected Users group in Active Directory and block outbound SMB as a temporary mitigation to minimize the impact of the attacks.\nTrending: Proof-of-concept for critical Microsoft Word vulnerability published\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Images-for-the-News-posts-5-1-300x150.png Kali Linux 2023.1 \u2013 Adds Kali Purple for defensive security, python updates, new toolsMarch 14, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Images-for-the-News-posts-3-1-300[...]", "creation_timestamp": "2026-09-04T19:00:04.574987Z"}