Threat Source newsletter (March 16, 2023) — A deep dive into Talos' work in Ukraine

Summary: Cisco Talos detailed a new threat actor it calls YoroTrooper, which runs espionage activity in Europe and Asia, has targeted high-profile government organizations including one in the European Union, and steals login credentials, browser histories, cookies, system information and screenshots. Microsoft's March security update disclosed 83 vulnerabilities, two of them exploited in the wild, including CVE-2023-23397, an Outlook privilege escalation flaw that triggers as soon as the targeted email server retrieves the email, without the user opening or previewing it.
Key Takeaway: An Outlook flaw that hands over the Windows account's Net-NTLMv2 hash the moment mail is retrieved means an attacker can harvest credentials from users who never clicked anything, so patching it is not a user-awareness problem. Separately, YoroTrooper has already succeeded against a high-profile EU government target, and Talos flags CIS users and organizations as especially exposed.

Read the original at Cisco Talos ↗

Topics: Threat Actors & Nation-State
Mentions: CVE-2023-23397
Related: Threat Brief - CVE-2023-23397 - Microsoft Outlook Privilege Escalation Cyber Risks ·
Fighting Ursa Aka APT28: Illuminating a Covert Campaign Cyber Risks ·
CVE-2023-23397: Microsoft Office Outlook Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Mar 14, 2023