{"id":126855,"date":"2023-03-24T11:30:00","date_gmt":"2023-03-24T18:30:00","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=126855"},"modified":"2024-07-03T07:48:16","modified_gmt":"2024-07-03T14:48:16","slug":"guidance-for-investigating-attacks-using-cve-2023-23397","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/24\/guidance-for-investigating-attacks-using-cve-2023-23397\/","title":{"rendered":"Guidance for investigating attacks using CVE-2023-23397"},"content":{"rendered":"\n
\n

February 15, 2024 update<\/strong> – On January 20, 2024, the US government conducted a disruption operation against infrastructure used by a threat actor we track as Forest Blizzard (STRONTIUM)<\/a>, a Russian state-sponsored threat actor, as detailed here: https:\/\/www.justice.gov\/opa\/pr\/justice-department-conducts-court-authorized-disruption-botnet-controlled-russian<\/a><\/p>\n<\/blockquote>\n\n\n\n

<\/p>\n\n\n\n

\n

December 4, 2023 update<\/strong> – Microsoft has identified a nation-state activity group tracked as Forest Blizzard (STRONTIUM)<\/a>, based in Russia, actively exploiting CVE-2023-23397 to provide secret, unauthorized access to email accounts within Exchange servers. The Polish Cyber Command (DKWOC) partnered with Microsoft to take action against Forest Blizzard actors, and to identify and mitigate techniques used by the actor: https:\/\/www.wojsko-polskie.pl\/woc\/articles\/aktualnosci-w\/detecting-malicious-activity-against-microsoft-exchange-servers\/<\/a>. Users should ensure Microsoft Outlook is patched and kept up to date to mitigate this threat. Microsoft Defender XDR detects the exploitation and known post-compromise activity of CVE-2023-23397. The only updates to the original blog below are in the \u201cWho is Forest Blizzard” section, reflecting our updated attribution, and added links to our product Threat Intelligence reports.<\/p>\n\n\n\n

Who is Forest Blizzard?<\/strong><\/p>\n\n\n\n

The group Microsoft tracks as Forest Blizzard (STRONTIUM)<\/a> is a Russian state-sponsored threat actor that primarily targets government, energy, transportation, and non-governmental organizations in the United States, Europe, and the Middle East. The United States and United Kingdom governments<\/a> have linked Forest Blizzard to Unit 26165 of the Russian Federation\u2019s military intelligence agency: Main Intelligence Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU).<\/p>\n\n\n\n

Forest Blizzard commonly seeks and employs publicly available exploits in addition to CVE-2023-23397. Beginning in at least the first half of September 2023, Forest Blizzard actors leveraged the WinRAR CVE 2023-38831<\/a> vulnerability to adapt spear-phishing operations against chiefly Ukrainian government targets. Other known exploits leveraged by Forest Blizzard include CVE-2021-40444<\/a>, CVE-2021-42292<\/a>, CVE-2021-42321<\/a>, CVE-2021-34473<\/a>, CVE-2020-17144<\/a>, and CVE-2020-0688<\/a>.<\/p>\n\n\n\n

Forest Blizzard continually refines its footprint by employing new custom techniques and malware, suggesting that it is a well-resourced and well-trained group posing long-term challenges to attribution and tracking its activities. Microsoft continually updates detections and protections against this threat group based on our telemetry and research. Other security researchers have used GRU Unit 26165, APT28<\/a>, Sednit<\/a>, Sofacy<\/a>, and Fancy Bear<\/a> to refer to groups with similar or related activities.<\/p>\n\n\n\n

<\/p>\n<\/blockquote>\n\n\n\n

<\/p>\n\n\n\n

This guide provides steps organizations can take to assess whether users have been targeted or compromised by threat actors exploiting CVE-2023-23397<\/a>. A successful exploit of this vulnerability can result in unauthorized access to an organization\u2019s environment by triggering a Net-NTLMv2 hash leak. Understanding the vulnerability and how it has been leveraged by threat actors can help guide the overall investigative process.<\/p>\n\n\n\n

This document covers:<\/p>\n\n\n\n