The malicious email does not require any user interaction and the vulnerability can be triggered without either reading the email or viewing the email in preview mode, the vulnerability will be triggered automatically when the Outlook client receives and processes the email. This property can contain a remote UNC path to an SMB (TCP port 445) share on a threat actor-controlled server. These obtained credentials were used for lateral movement within the victim’s networks.Īttackers are able to craft an email that contains an extended MAPI property called PidLidReminderFileParameter for either a calendar appointment, note or task. This vulnerability was observed to be used by nation-state actors targeting Ukraine’s government, military, energy, and transport sector during Mid-April and December 2022.īy sending malicious Outlook notes and tasks, the attackers were able to steal NTLM hashes via NTLM negotiation requests by forcing the targets’ devices to authenticate to attacker-controlled SMB shares. Microsoft reported having been notified by Cert-UA of a zero-day vulnerability in Outlook.

Soundforge mac