Microsoft: Russia: Massive cyberattack hits electronic voting in Moscow during state elections

Critical Zero-Day Exploit in Progress: Microsoft Confirms Active Attacks on Office Flaw

Microsoft has issued an urgent warning about a zero-day vulnerability (CVE-2024-38200) in its Office suite, currently being exploited in the wild. The flaw, rated 7.8 (High) on the CVSS scale, allows attackers to execute arbitrary code with the privileges of the targeted user, potentially leading to full system compromise.

Key Details:

• Who: Microsoft, alongside cybersecurity researchers at Morphisec, identified the vulnerability. Threat actors, likely state-sponsored or financially motivated, are actively exploiting it.
• What: The flaw resides in Office’s MSHTML (Trident) engine, enabling remote code execution (RCE) when victims open malicious documents even without macros enabled. Attackers can bypass security controls by leveraging specially crafted files.
• When: Exploits were first detected in late July 2024, with Microsoft confirming active attacks in early August. A patch is expected in the August 2024 Patch Tuesday release (August 13).
• Where: Targets include enterprise users, government agencies, and high-value individuals globally, with initial attacks concentrated in North America and Europe.
• Why: The vulnerability is being weaponized for espionage, data theft, and ransomware deployment, exploiting the widespread use of Office in corporate and institutional environments.

Impact:
Successful exploitation grants attackers persistent access, lateral movement within networks, and the ability to deploy additional malware. Organizations using unpatched versions of Office (2013–2021, including 365) are at risk. Microsoft has released mitigation guidance, including disabling MSHTML via Group Policy, but a full fix awaits the upcoming update.

The incident underscores the growing trend of zero-day exploits targeting productivity software, with attackers increasingly bypassing traditional defenses like macro restrictions.

Source: https://www.wionews.com/short-videos/russia-massive-cyberattack-hits-electronic-voting-in-moscow-during-state-elections-1789826704734

Microsoft TPRM report: https://www.rankiteo.com/company/microsoft-security

"id": "mic1789871027",
"linkid": "microsoft-security",
"type": "Vulnerability",
"date": "9/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'customers_affected': 'Enterprise users, government '
                                              'agencies, high-value '
                                              'individuals',
                        'industry': ['Corporate',
                                     'Government',
                                     'Institutional'],
                        'location': ['North America', 'Europe'],
                        'name': 'Microsoft Office Users',
                        'type': 'Software/Enterprise'}],
 'attack_vector': 'Malicious Office documents (MSHTML engine)',
 'data_breach': {'data_exfiltration': 'Potential data theft'},
 'date_detected': '2024-07-01',
 'date_publicly_disclosed': '2024-08-01',
 'description': 'Microsoft has issued an urgent warning about a zero-day '
                'vulnerability (CVE-2024-38200) in its Office suite, currently '
                'being exploited in the wild. The flaw allows attackers to '
                'execute arbitrary code with the privileges of the targeted '
                'user, potentially leading to full system compromise. The '
                'vulnerability resides in Office’s MSHTML (Trident) engine, '
                'enabling remote code execution (RCE) when victims open '
                'malicious documents even without macros enabled.',
 'impact': {'data_compromised': 'Potential data theft',
            'operational_impact': 'Persistent access, lateral movement within '
                                  'networks, malware deployment',
            'systems_affected': 'Microsoft Office (2013–2021, including 365)'},
 'investigation_status': 'Ongoing',
 'motivation': ['Espionage', 'Data theft', 'Ransomware deployment'],
 'post_incident_analysis': {'corrective_actions': 'Patch development in '
                                                  'progress',
                            'root_causes': 'Zero-day vulnerability in MSHTML '
                                           'engine'},
 'ransomware': {'data_exfiltration': 'Potential'},
 'references': [{'source': 'Microsoft Security Response Center'},
                {'source': 'Morphisec'}],
 'response': {'containment_measures': 'Disabling MSHTML via Group Policy',
              'remediation_measures': 'Patch expected in August 2024 Patch '
                                      'Tuesday (August 13)',
              'third_party_assistance': 'Morphisec'},
 'threat_actor': ['State-sponsored', 'Financially motivated'],
 'title': 'Critical Zero-Day Exploit in Progress: Microsoft Confirms Active '
          'Attacks on Office Flaw (CVE-2024-38200)',
 'type': 'Zero-Day Exploit',
 'vulnerability_exploited': 'CVE-2024-38200'}