[German]A 0-day vulnerability CVE-2022-30190 (Follina) in Windows has been known since the end of May 2022. Yesterday, a tip from a security researcher came to my attention, who has not yet found any active exploitation via manipulated Office documents. On the other hand, Proofpoint reports that they have just stopped a phishing campaign attacking customers at EU and US government agencies. State actors are suspected to be behind the action. An attack was also observed in the South Pacific, originating from servers in Palau. In the process, a digital certificate from a company was misused for signing. The CERT-UA also warns of attacks on government targets in Ukraine. Time for a brief stocktake around the exploitation of Follina.
Continue reading →