RomCom exploiting Word vulnerability in campaign targeting government entities

In June 2023, Storm-0978 launched a campaign exploiting the CVE-2023-36884 vulnerability, a remote code execution flaw in Microsoft Word documents. This campaign targeted defense and government entities in Europe and North America, using phishing emails with lures related to the Ukrainian World Congress. The emails contained malicious documents designed to exploit the vulnerability before it was disclosed, allowing the attackers to deliver a backdoor with similarities to the RomCom malware. The campaign's primary objective appeared to be intelligence gathering, leveraging the vulnerability to infiltrate systems and potentially steal sensitive credentials. Microsoft Defender for Office 365 detected the initial exploitation, and further recommendations were provided to mitigate the threat. This operation exemplifies Storm-0978's ability to exploit zero-day vulnerabilities and their focus on espionage-related activities.