Follina

Follina (CVE-2022-30190) is a software vulnerability that was discovered and exploited in the first half of 2022. It was weaponized by TA413, a malicious entity known for its cyber attacks, shortly after its discovery and publication. The vulnerability was used to target the Sophos Firewall product, Microsoft Windows Support Diagnostic Tool (MSDT), and other software. In addition to Follina, TA413 also exploited another zero-day vulnerability (CVE-2022-1040) and employed a custom backdoor tracked as LOWZERO in campaigns specifically targeting Tibetan entities. The Follina exploit was utilized in various ways, including through .docx files and an EXE file made by PyInstaller that was executed post-exploitation. One notable instance involved a phishing campaign where emails were sent in two waves, the first containing a Microsoft Word .docx attachment hosted on Google Firebase that attempted to use the Follina vulnerability, and the second linked to a .RAR archive file containing both the malicious Microsoft Word attachment and a decoy .png image file. Investigations confirmed that not only TA413 but also APT28 and a China-nexus attack group had exploited Follina. These groups also exploited other vulnerabilities such as those affecting Roundcube application and Outlook. The exploitation of Follina led to the execution of a Base64-encoded PowerShell command to download a follow-on payload from a specific URL. The fact that multiple groups have been exploiting Follina suggests that they may have access to a zero-day or are capable of developing one.