{"id":54771,"date":"2023-12-06T00:15:15","date_gmt":"2023-12-06T00:15:15","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/fancy-bear-goes-phishing-in-us-european-high-value-networks\/"},"modified":"2023-12-06T00:15:15","modified_gmt":"2023-12-06T00:15:15","slug":"fancy-bear-goes-phishing-in-us-european-high-value-networks","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/fancy-bear-goes-phishing-in-us-european-high-value-networks\/","title":{"rendered":"Fancy Bear goes phishing in US, European high-value networks"},"content":{"rendered":"

Fancy Bear, the Kremlin’s cyber-spy crew, has been exploiting two previously patched bugs for large-scale phishing campaigns against high-value targets \u2013 like government, defense, and aerospace agencies in the US and Europe \u2013 since March, according to Microsoft. <\/p>\n

The US and UK governments have linked this state-sponsored gang to Russia’s military intelligence agency, the GRU. Its latest phishing expeditions look to exploit CVE-2023-23397<\/a>, a Microsoft Outlook elevation of privilege<\/a> flaw, and  CVE-2023-38831<\/a>, a WinRAR remote code execution flaw that allows arbitrary code execution.<\/p>\n

Microsoft initially patched the Outlook bug in March. It warned at the time that the flaw had already been exploited<\/a> in the wild by miscreants in Russia against government, energy, and military sectors in Europe \u2013 with a specific focus on Ukraine<\/a>, according to the EU’s CERT org. Two months later, Redmond issued an additional fix<\/a>.<\/p>\n