{"uuid": "a6194a1b-ea6c-45c4-a278-c978c5a076f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30190", "type": "exploited", "source": "https://t.me/hacking_Attack/58624", "content": "Black Hat Ethical Hacking\nFancy Bear Uses Nuke Threat Lure to Exploit 1-Click Bug\n\nFancy Bear Uses Nuke Threat Lure to Exploit 1-Click BugPost Views: 3 \nPremium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nAdvanced persistent threat group Fancy Bear is behind a\u00a0phishing campaign\u00a0that uses the specter of nuclear war to exploit a known one-click Microsoft flaw.\nThe goal is to deliver malware that can steal credentials from the Chrome, Firefox and Edge browsers.\n\nThe attacks by the Russia-linked APT are tied the Russian and Ukraine war, according to researchers at Malwarebytes Threat Intelligence. They report that Fancy Bear is pushing malicious documents weaponized with the exploit for Follina\u00a0(CVE-2022-30190), a known Microsoft one-click flaw, according to a blog post\u00a0published this week.\n\n\u201cThis is the first time we\u2019ve observed APT28 using Follina in its operations,\u201d researchers wrote in the post. Fancy Bear is also known as APT28, Strontium and Sofacy.\n\nOn June 20, Malwarebytes researchers first observed the weaponized document, which downloads and executes a .Net stealer first reported by Google. Google\u2019s Threat Analysis Group (TAG) said Fancy Bear already has used this stealer to target users in the Ukraine.\n\nThe Computer Emergency Response Team of Ukraine (CERT-UA) also independently discovered\u00a0the malicious document used by Fancy Bear in the recent phishing campaign, according to Malwarebytes. Bear on the LooseCERT-UA previously identified\u00a0Fancy Bear as one of the numerous APTs pummeling Ukraine with cyber-attacks in parallel with the invasion by Russian troops that began in late February. The group is believed to be operating on the behest of Russian intelligence to gather info that would be useful to the agency.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png In the past Fancy Bear has been linked in attacks targeting elections in the United States\u00a0and Europe, as well as hacks against sporting and anti-doping agencies\u00a0related to the 2020 Olympic Games.\n\nResearchers first flagged Follina in April, but only in May\u00a0was it officially identified as a zero-day, one-click exploit. Follina is associated with the Microsoft Support Diagnostic Tool (MSDT) and uses the ms-msdt protocol to load malicious code from Word or other Office documents when they\u2019re opened.\n\nThe bug is dangerous for a number of reasons\u2013not the least of which is its wide attack surface, as it basically affects anyone using Microsoft Office on all currently supported versions of Windows. If successfully exploited, attackers can gain user rights to effectively take over a system and install programs, view, change or delete data, or create new accounts.\n\nMicrosoft recently patched Follina in its June Patch Tuesday\u00a0release but it remains under active exploit\u00a0by threat actors, including known APTs.\nThreat of Nuclear Attack\nFancy Bear\u2019s Follina campaign targets users with emails carrying a malicious RTF file called \u201cNuclear Terrorism A Very Real Threat\u201d in an attempt to prey on victims\u2019 fears that the invasion of Ukraine will escalate into a nuclear conflict, researchers said in the post. The content of the document is an article\u00a0from the international affairs group Atlantic Council that explores the possibility that Putin will use nuclear weapons in the war in Ukraine.\n\nThe malicious file uses a remote template embedded in the Document.xml.rels file to retrieve a remote HTML file from the URL http://kitten-268[.]frge[.]io/article[.]html. The HTML file then uses a JavaScript call to window.location.href to load and execute an e[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T16:00:04.683684Z"}