ClosedPatched

Outlook zero-click NTLM hash leak used by Russian state hackers (CVE-2023-23397)

Microsoft Outlook for Windows

A crafted Outlook reminder with a UNC path made Outlook for Windows send the user's NTLM hash to an attacker's server without any click. Microsoft said a Russia-based actor (APT28) used it against European government, transport, energy and military targets.

Why this severity: CVSS 9.8 (NVD), zero-click, zero-day, actively exploited (CISA KEV)

Started: Mar 14, 2023
Closed: Mar 24, 2023
CVE: CVE-2023-23397

Follow this incident

Updated Mar 24, 2023

Affected

See vendor advisory

Fixed in

See vendor advisory (March 2023 security updates)

Timeline2

Mar 24, 2023
Microsoft publishes investigation guidance for CVE-2023-23397
Source
Mar 14, 2023
Patch Tuesday fix; CISA adds CVE-2023-23397 to KEV
Source

Advisories4

News & write-ups1

Guidance for investigating attacks using CVE-2023-23397Microsoft · Mar 24, 2023 · Write-up

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified