Russian Malicious Outlook Calendar Invites Targeting Ukraine (CVE-2023-23397) | Threat SnapShot

In this week's Threat SnapShot, we'll take a look at a privilege escalation attack affecting Microsoft Outlook that has been used by a Russian nation-state actor (APT28, Fancy Bear, GRU) against organizations in Ukraine. The vulnerability, CVE-2023-23397, was addressed in Microsoft's most recent patch Tuesday (March 2023). Evidence of exploitation, however, has been seen to date back to at least April 2022. The attack leverages a relatively obscure feature of Outlook, where calendar invites can contain a file path for an alternative notification sound. An attacker can specify a UNC path, and Outlook will happily pass along the user's NTLM credentials to try to authenticate to that path, leading to an escalation of privilege and credential compromise.

We'll take a closer look at three example attack variations using this vulnerability -- one that passes the credentials via WebDAV, another that relays the NTLM credentials to gain an SMB shell on the victim, and a third that uses this vulnerability as a persistence mechanism by setting a registry key. We'll also discuss detection and threat hunting strategies to protect your organization from each of these attack vectors.

Resources:

SnapAttack Content:

[iknowaguyllc]

MS guidance only specifies blocking 445 outbound, no mention of webdav. If smb is blocked at the edge wouldn’t it just fall back to webdav as in your example?

[edemfromeden]

Great stuff! What’s confusing to me, what if you have O365 but using PTA authentication ? I mean they state O365 is not vulnerable but that’s ultimately the Outlook client that will initiate communication with the adversary controlled UNC path, so the hash could be stolen anyway. What the adversary can then do with the hash is a different story. Am I correct?