Follina

Follina, also known as CVE-2022-30190, is a notable software vulnerability that was discovered and exploited in the first half of 2022. This flaw, found in the Microsoft Windows Support Diagnostic Tool (MSDT), was weaponized by TA413, a cyber threat actor group with suspected ties to China. The group utilized Follina shortly after its discovery and publication, demonstrating their ability to rapidly exploit newly disclosed vulnerabilities. In addition to Follina, TA413 also targeted the Sophos Firewall product using a now-patched zero-day vulnerability (CVE-2022-1040) and employed a custom backdoor tracked as LOWZERO in campaigns primarily aimed at Tibetan entities. The exploitation of Follina involved the use of malicious .docx files and executables. Phishing emails were sent in two waves; the first wave linked to a Microsoft Word .docx attachment hosted on Google Firebase service that attempted to exploit Follina, while the second wave linked to a .RAR archive file containing both the malicious Microsoft Word attachment and a decoy .png image file. Once triggered, the Follina exploit would execute a Base64-encoded PowerShell command to download a follow-on payload from an external server. Additionally, an EXE file made by PyInstaller was found to be executed post-exploitation of Follina. Investigations into these attacks led to the identification of a China-nexus attack group as the perpetrators. This group demonstrated not only the capability to exploit Follina but also the potential to access or develop other zero-day vulnerabilities. To carry out reconnaissance and data collection, the attackers also exploited other vulnerabilities, including CVE-2020-12641 in Roundcube webmail. As such, understanding and mitigating the risk associated with the Follina vulnerability, as well as other potential threats, remains a critical task for cybersecurity professionals.