Threat actors have been actively exploiting the already patched “Follina,” Microsoft Windows Support Diagnostic Tool (MSDT) remote code execution (RCE) vulnerability in a phishing campaign to inject a new remote shell backdoor known as “Rozena” on vulnerable Windows instances. Follina, tracked as CVE-2022-30190, is a flaw in the MSDT URI protocol handler that allows threat actors to weaponize Word documents to locally execute remotely hosted malicious PowerShell scripts, leading to arbitrary code execution (ACE) utilizing the privileges of the calling application. Researchers from Fortinet have been monitoring this newest campaign, identifying a Word document that exploits Follina to download Rozena after luring a victim into opening the document. Once opened, the malicious document connects to and leverages a Discord CDN attachment service to download an HTML file, which invokes msdt.exe via a PowerShell script. The code downloads a single batch file known as “cd.bat”, which executes four (4) tasks. It downloads a second document as a distraction, erases any trace of exploiting Follina, downloads Rozena, and finally deletes the “cd.bat” file. The distraction document is benign and is used to coerce the victim into opening the malicious executable (disguised as a Word document and titled “Word.exe”). Once the “Word.exe” Rozena file is executed, it creates a reverse shell back to the attacker-controlled host. Once the attack is successfully executed, the threat actors can monitor the target, as well as exfiltrate sensitive data, all while maintaining a persistent backdoor to the victim machine. CTIX analysts recommend that any Windows instances vulnerable to Follina should be updated immediately with the latest patch. As a best practice, we recommend always scrutinizing emails and email attachments before clicking any links or files.