First Exploitation of Follina Seen in the Wild

Published: 2022-05-31
Last Updated: 2022-05-31 14:34:03 UTC
by Xavier Mertens (Version: 1)
2 comment(s)

For a few days, "Follina" is generating a lot of noise on the Internet, check our yesterday diary[1] about this new vulnerability if you need more details. It was time to hunt for some samples. For this purpose, I created a simple YARA rule on VT:

import "vt"
rule hunt_0day_msdt
        $s1 = "!\" TargetMode=\"External\"/>" nocase wide ascii
        new_file and all of ($s*) and vt.metadata.file_type == vt.FileType.DOCX

The rule is pretty simple but is doing a great job and the amount of false-positive hits are acceptable, thanks to the trailing "!" that must be present at the end malicious URLs found in the documents.

It seems that many security researchers (or redteams, pentesters?) are working on proof-of-concept documents, I detected a lot of documents embedding an URL with RFC1918 IP addresses:

But finally, I received a positive alert. The document was uploaded from Ireland but has a filename with Chinese characters. Google Translate returns the following translations:

Mobile phone room to receive orders - channel quotation - the lowest price on the whole network.docx

Of course, the tactic used in the document is exactly the same but URLs and payload are different:


The payload:

And the decoded Base64 string:

The malware is still available and I downloaded a copy (SHA256:3206fe87e2874db37239d64779c1f504cfca528cef8f5c2214f8434b392aa25a). It has a VT score of 16/68[2]. The domain to drop the payloads has been registered on May, 23rd 2022.

If not done yet, it's a good time to have a look at the document[3] released by Microsoft to mitigate this vulnerability! 


Xavier Mertens (@xme)
Senior ISC Handler - Freelance Cyber Security Consultant

2 comment(s)


Hi! I think the first evidence of exploitation dates back around April ( Hash: 710370f6142d945e142890eb427a368bfc6c5fe13a963f952fb884c38ef06bfa). This was mentioned by Kevin Beaumont (@GossiTheDog) in his blog The CVE that was credited to @CrazymanArmy, who reported it Microsoft back in April, after seeing what appears to be an exploitation of msdt (
I agree with that point. The diary title should be read as “we are now staring to see the first exploitation after the disclosure”.

Diary Archives