Microsoft has published step-by-step guidance for detecting and blocking an actively exploited critical zero-day vulnerability affecting Microsoft Outlook. The guidance shows administrators how to identify indicators of compromise (IOC) to ascertain if they’ve already been compromised, as well as how to detect active attack attempts and defend their servers from the future exploitation of this flaw. The vulnerability, tracked as CVE-2023-23397, is an escalation of privilege flaw that allows privileged Net-NTLMv2 hashes to leak without any user interaction. The hashes can then be collected, weaponized, and redirected to perform NTLM-relay attacks by sending maliciously crafted emails to vulnerable Outlook instances. Successful exploitation allows the threat actor to manipulate the victim’s session, allowing them to authenticate as the victim by “sending messages with extended MAPI properties containing UNC paths to attacker-controlled SMB shares.” The pilfered credentials that the threat actors exfiltrate can be used for lateral movement, as well as changing vulnerable Outlook mailbox folder privileges, allowing the attackers to redirect sensitive emails from targeted accounts to their own command-and-control (C2) infrastructure. The exploitation of this flaw has been attributed by Microsoft to “a Russia-based threat actor,” with other researchers believing it could be APT28 (STRONTIUM, Sednit, Sofacy, and Fancy Bear). CTIX analysts urge all Outlook and Exchange administrators to ensure that the guidance in the linked advisory is strictly followed to prevent their networks from being compromised.