Unpatched Office Zero-day Exploited at NATO Summit: Implications and Mitigation

Microsoft's recent disclosure of a critical zero-day security vulnerability affecting various Windows and Office products has sent shockwaves through the cybersecurity community. In this blog post, we will delve into the significance of this issue, its potential impact, actionable mitigation measures, and shed light on the exploitation of the vulnerability in targeted attacks against attendees of the NATO Summit.

1. Windows and Office Zero-day Exploitation: Microsoft recently revealed an unpatched zero-day security vulnerability (CVE-2023-36884) that affects multiple Windows and Office products. Exploiting this flaw allows attackers to remotely execute arbitrary code through malicious Office documents. What makes this vulnerability particularly dangerous is the fact that unauthenticated attackers can exploit it without any user interaction, giving them the ability to carry out sophisticated attacks without constraints.

2. Severity and Implications:
This vulnerability poses a severe threat, as successful exploitation can compromise confidentiality, availability, and integrity. Attackers can gain unauthorized access to sensitive information, disable system protection, and deny access to compromised systems. The implications of such a breach can be detrimental to organizations and their stakeholders.

3. Microsoft's Response:
Microsoft is actively investigating reports of remote code execution vulnerabilities impacting Windows and Office products. The company has acknowledged targeted attacks using specially-crafted Microsoft Office documents. While victims need to open the malicious file, Microsoft is committed to addressing these vulnerabilities through monthly patches or out-of-band security updates. Timely action is crucial to ensure system security.

4. Mitigation Measures: While waiting for official patches for CVE-2023-36884, Microsoft recommends specific mitigation measures. Customers using Defender for Office and those who have enabled the "Block all Office applications from creating child processes" Attack Surface Reduction Rule are already protected against phishing attacks exploiting the vulnerability. For those without these protections, the following applications should be added as REG_DWORD values with data 1 to the registry key:            [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\InternetExplorer\Main\FeatureControl\FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION] 

• Excel.exe
• Graph.exe
• MSAccess.exe
• MSPub.exe
• PowerPoint.exe
• Visio.exe
• WinProj.exe
• WinWord.exe
• Wordpad.exe

Implementing this registry key may impact certain Microsoft Office functionalities related to the listed applications. It's essential to weigh the trade-offs while prioritizing system security.

5. Exploitation in NATO Summit Attacks:
The CVE-2023-36884 vulnerability was recently exploited in targeted attacks against organizations attending the NATO Summit in Vilnius, Lithuania. Reports from Ukraine's Computer Emergency Response Team (CERT-UA) and BlackBerry's intelligence team document the use of malicious documents impersonating the Ukrainian World Congress organization. These documents delivered malware payloads, including the MagicSpell loader and the RomCom backdoor.

6. RomCom's Links to Ransomware and Remote Code Execution:
According to Microsoft, the exploitation of CVE-2023-36884 involves leveraging a specially crafted document to execute a vulnerable version of MSDT, enabling the attacker to pass a command to the utility and execute it. In a campaign detected in June 2023, the actor exploited CVE-2023-36884 to deliver a backdoor with resemblances to RomCom. Microsoft disclosed this information on Tuesday. The exploitation of CVE-2023-36884 allows attackers to conduct remote code execution attacks through crafted .docx or .rtf documents. Microsoft has linked the attackers behind these exploits to the Russian-based cybercriminal group known as RomCom (Storm-0978).

Conclusion:
The discovery and exploitation of this unpatched zero-day vulnerability in Windows and Office products, particularly in targeted attacks against the NATO Summit, highlight the critical importance of robust cybersecurity measures. While Microsoft is diligently working on providing patches and security updates, organizations must proactively take steps to protect their systems and data.

At Armoryze, we specialize in comprehensive cybersecurity solutions. Our Risk-based Vulnerability Management prioritizes vulnerabilities for efficient risk mitigation. With Managed Detection and Response (MDR), we utilize advanced threat intelligence and round-the-clock monitoring to detect and respond to threats in real-time. Our expert team develops tailored strategies and delivers rapid incident response to minimize the impact of cyber attacks.

Schedule a FREE consultation with Armoryze today to strengthen your security posture and protect your organization's valuable assets.