Fighting Ursa Aka APT28: Illuminating a Covert Campaign
Summary: Unit 42 researchers observed Fighting Ursa, a group attributed to Russia's GRU Unit 26165, using the Outlook zero-day CVE-2023-23397 over 20 months against at least 30 organizations in 14 nations, including a third campaign from September to October 2023 targeting at least nine organizations in seven nations. The exploit requires no user interaction and triggers an NTLM relay attack in which Outlook sends an NTLMv2 hash to an attacker-controlled file share, which the group uses to impersonate the victim and move within the network.
What you should know: Fighting Ursa kept using this vulnerability after it was publicly attributed to them and patched in March 2023, including a message to a Montenegrin Ministry of Defense account on Oct. 11, 2023 - a sign the intelligence gained outweighed the risk of discovery, and that unpatched Outlook remains an open door for a state military unit.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2023-23397
- Related
- CVE-2023-23397: Microsoft Office Outlook Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Mar 14, 2023