Full transcript
0:00On the second Tuesday of every month,
0:01Microsoft does what they call Patch
0:03Tuesday, where they release different
0:05updates or security fixes to address
0:07bugs or vulnerabilities. But sometimes
0:09they release emergency out-of-band
0:11updates to patch and fix actively
0:14exploited zero-day vulnerabilities. And
0:17that is exactly the case with this
0:18recent bug in Microsoft Office. This is
0:21a news report from Bleeping Computer,
0:23where they're tracking a security
0:24feature bypass vulnerability tracked as
0:27CVE-2026215
0:3009. And if you take a look on the
0:32Microsoft Resource Center, it's
0:33literally called a security feature
0:35bypass vulnerability. With a max
0:38severity of important, it is a high
0:40severity risk with a big old CVSS of
0:427.8. Still something to take seriously
0:44here. But the description isn't all that
0:46helpful. They say, "Oh, reliance on
0:48untrusted inputs allows an unauthorized
0:50attacker to bypass a security feature
0:53locally." It hasn't been publicly
0:54disclosed, but it has been exploited.
0:57Just recently, at the start of February,
0:59Bleeping Computer comes out with another
1:01article that Russian hackers are the
1:03ones actively exploiting this now
1:05patched bug in Microsoft Office.
1:08CVE-202621509
1:11was observed by Ukraine's Computer
1:14Emergency Response Team. They saw active
1:16exploitation with distribution of
1:18malicious doc files, like Microsoft Word
1:21documents, exploiting this flaw. Just a
1:24couple days after Microsoft put it all
1:27on high alert. But the metadata
1:29associated with the files said this
1:31thing was made just a day after. And
1:35they're attributing it to APT28 or
1:38Russia. Russia hacking with zero-days
1:40again. Here we go. Now, this is the
1:42original report, and I'll of course have
1:43links for everything in the video
1:45description. And I can't read this, so
1:47let me run this through Google
1:48Translate. Super quick timeline, right?
1:50January 26th is when Microsoft is
1:52chatting about this CVE. January 29th is
1:55when they started to see these specific
1:57files being sent out. But, they note
1:59January 27th, just the day after, is
2:02when the file was created. And the files
2:04in question here are those .doc or
2:07Microsoft Word document files, right?
2:09Consultation topics Ukraine final or
2:11bulletin_h.
2:13That one being sent to like 60 email
2:16addresses, mainly executive authorities
2:18of Ukraine. Okay, so we'll fall down the
2:20rabbit hole and talk a little bit about
2:22it. I don't want to go through
2:23everything because I don't think we have
2:25all the parts and puzzle pieces that we
2:26need to, but there are some really
2:28interesting things that we can discuss.
2:30And the best part is they did give us
2:32some IOCs, indicators of compromise, or
2:35the SHA-256 hashes to be able to go
2:37track these down. Now, I didn't realize
2:39the first time I was looking through
2:40this you kind of had to like scroll
2:42horizontally. So, it does correlate,
2:44okay, what file name associates with
2:45what, and we'll go explore those. We can
2:48use VirusTotal to try and find some of
2:50those SHA-256 hashes and see if they
2:52were uploaded and might be available for
2:54download. In which case, this
2:56bulletin_h.doc
2:58is something we could pull down. But,
3:00with this being super emergent, pretty
3:02recent from January's Patch Tuesday, the
3:05end of the month, and now getting into
3:06February, I thought it was pretty cool.
3:08Hey, some of my friends are talking
3:09about this. Flare had a sweet blog post
3:12and write-up while they were digging
3:13into just about everything from the
3:15January 2026 Patch Tuesday, all of the
3:18vulnerabilities and all of the kind of
3:20exploits that they were discussing,
3:21along with, oh, kind of sweet graphs to
3:23see how these things vary over time.
3:25But, they went through all this and of
3:27course they highlighted the big one here
3:29in that out-of-band emergency update,
3:32CVE-2026-21509.
3:35They talk a little bit about it, note
3:37it's coming from APT28, Russia, the
3:39group best known for their work behind
3:41the Hillary Clinton email attack in
3:422016. Okay, and then they kind of see,
3:45oh, are there any hits, are there any
3:46other threat actors, cybercriminals, and
3:48adversaries chatting about it on Flare?
3:50Now, you know, I'm a huge fan of Flare.
3:52I think they do some really cool stuff.
3:54They are a channel partner and they are
3:55the sponsor of this video. I super
3:57appreciate all their support. So, I did
3:58want to give them just a little bit of
4:00love and we can go take a look. Are any
4:01other threat actors chirping about this
4:03thing with their platform? Let me go
4:05search for anything and everything
4:07pertinent to CVE-2026-21509.
4:11And there's stuff in Telegram. A lot of
4:13folks are chatting about it across
4:14different forums. Some malware news. I
4:17think mostly folks are just kind of
4:19regurgitating and like resyndicating oh
4:21the alerts, notifications that oh this
4:23is out and about. But across like 107
4:26events between of course the dark web
4:29and all of the shady places there and
4:30the open internet, there's a lot to kind
4:32of at least see what are folks saying.
4:34That is the real perk of Flare being
4:36able to see everything that they are
4:37tracking across infos either malware
4:39logs, chat messages sent over Telegram,
4:42and ransomware leak sites, dark web
4:43marketplaces, forums, and all the sweet
4:45stuff. I just thought it was pretty cool
4:47that Flare was actually tracking even
4:49some analysis of vulnerabilities
4:50following Patch Tuesday and they put
4:52that out totally for free. They've got a
4:55whole huge breakdown of everything that
4:57they were tracking here and just thought
4:59it was cool. Wanted to show it to you
5:01and hey, big love for Flare. You can get
5:03some of that sweet threat intelligence
5:04to augment public information, what's
5:07going down on the dark web and Telegram
5:09chats with Flare and a free trial. I'll
5:11have a link for that in the video
5:12description. Thank you so much for Flare
5:14and their support. But anyway, let's get
5:16back to that CERT-UA write-up and some
5:18of our malicious CVE-2026-21509.doc
5:23files to see how they've been beating up
5:25the security bypass in Microsoft Office
5:27documents or Word docs. And
5:30specifically, it looks like it is a
5:32network connection with an external
5:34resource using WebDAV. That means it
5:37downloads a file, in this case a
5:39shortcut file, and that will even
5:41trigger another download and run an
5:43executable file. So, say a hacker
5:45tricked you into opening this word doc,
5:48and then immediately it were to actually
5:50open up and execute and run some remote
5:52untrusted code. So, I've pulled down one
5:54of those suspect files, bulletin_h.doc,
5:58into a virtual machine for us. I'm using
6:00Remnux, the reverse engineering malware
6:02Linux distribution, and I would love to
6:04be able to showcase this in Windows,
6:06like with Microsoft Office, and try to
6:07see the thing fire, but I'll admit I
6:09don't quite have another Office setup
6:11install available. I feel like I used
6:13to, but try to clean up a lot of my
6:15virtual machine mess, and I no longer
6:16do. But, I do have in a malware
6:19directory our Office CVE and the
6:22bulletin_h.doc file. We were able to
6:24pull that from VirusTotal, as you know,
6:27and it is a rich text format file, which
6:30of course could still be open in
6:32Microsoft Word, but because it is just
6:34simply text, we could open it up in a
6:36text editor. And it is this thing. Now,
6:39a lot of this is boilerplate. You'll see
6:42a lot of the syntax here kind of setting
6:44fonts, or setting a header, setting the
6:46layout, setting some of the designs, or
6:48maybe some pictures that are included.
6:50And with all of that, you've got some
6:52random values and numbers and stuff.
6:55But, if we know this vulnerability is
6:56all about OLE, or the object linking and
6:59embedding, you might have caught that
7:01even in just a bleeping computer
7:03articles that we mentioned, the update
7:05that Microsoft rolled out addresses the
7:07vulnerability that bypasses OLE
7:09mitigations. Protect users from
7:11vulnerable COM, or the component object
7:12model, and OLE object linking and
7:14embedding controls. So, with this
7:16referencing objects, those are pretty
7:18well defined in the RTF format, or rich
7:21text format, with like a backslash
7:24object reference. And you'll see a
7:26couple of hits for these that then
7:28include a lot of the numbers, or like
7:29raw data, hexadecimal really. We're
7:31looking for the ones that do have
7:33objemb, or embedding that as something
7:36else. Actually, I could just search for
7:38objemb for embedding here. There are
7:40only a couple of these. But, what's to
7:42stop us from ripping out that content
7:45and then trying to decode or unravel
7:48what might be included in the
7:50hexadecimal data here because there is a
7:52lot. We're looking through like what?
7:53Almost 20,000 lines of this file. So,
7:56maybe some command line magic. Let me go
7:58ahead and cat out that file, get
8:00everything to standard output, and then
8:02I want to just simply grep for anything
8:05that is actually hexadecimal. So, I'll
8:07I'll use regular expressions here. So,
8:09the dash capital E, and then what I'm
8:11searching for inside of a group, I want
8:13the regular hexadecimal character set.
8:15So, the numbers 0 through 9, and then
8:17because that's base 16, it adds up to
8:19other letters A through F. And we can
8:21make that greedy. Let's just add a plus
8:23sign, and I think that's going to get us
8:24what we want. At the very least, we get
8:26a boatload of numbers, right? I'll admit
8:28that's a pretty dirty approach, and
8:30we're going to get a lot of false
8:32positives, but ultimately, I just want
8:34to rip out, carve through all of the
8:36different hexadecimal values, or at
8:38least stuff that looks like it so that I
8:39can decode it and then try to find just
8:41the breadcrumb, just the puzzle piece
8:43that says, "Ooh, there's a smoking gun.
8:45I see a WebDAV protocol, or I see some
8:48external weird random domain or IP
8:50address." So, actually, with all of
8:53those now attempted hex values pulled
8:56out, we could use XXD to work with hex,
8:59-r to like reverse it to get decoded
9:03hex, and -p to print that out. Now,
9:05you'll see there's a lot of other noise,
9:08but some parts and pieces that look like
9:11actually potentially valuable data. All
9:13this gunk though for non-printable
9:15characters though, we could probably
9:16clean out with just strings, s t r i n g
9:20s if I could learn to type. But, strings
9:22by default will print things that are
9:24plain text or again, actual printable
9:26characters, not those weird random
9:28Unicode question mark symbols we saw
9:30with the minimum length being four
9:32characters by default. So, you'll see
9:34some weird stuff here that maybe we
9:35don't care about, but again, more parts
9:37and pieces that are actually pertinent
9:39to what we would be interested in,
9:41somewhat human-readable data. But, we
9:43could actually tweak that with the
9:45{dash}n argument and bring that to like
9:4812 or 10 or 15, something other than
9:50four, so we'll have less of those noise
9:52and nonsense. But, ooh, now we start to
9:54see amongst tweet, tweet, tweet, tweet,
9:56tweet entries, some strange potential
9:59local IP addresses, 192.168.217.250,
10:03which is weird, but if I just take a
10:05look through here, you're seeing parts
10:07and pieces that might make up a regular
10:09Word document file, but you see this
10:12here? Smoking gun, two backslashes
10:15indicating, okay, external resource,
10:17maybe SMB over the network, but {dab}www
10:21root, WebDAV, to a file Venetia
10:25Favorites blank.doc.
10:27That is what they are pulling down and
10:31what they've just smuggled in to this
10:33specific file, bulletin_h.doc.
10:36Not a whole lot else to look through
10:37here, that's just the part and piece
10:39that we were curious about because that
10:41is the WebDAV reference. Ultimately,
10:44that uses the DLL file ehstore.shell,
10:47disguised as some enhanced storage shell
10:49extension with a image file or
10:52splashscreen.png
10:54that has shellcode inside it. That
10:57shellcode ends up changing the path of
10:58the Windows registry for a class ID,
11:01CLSID D9144DCD,
11:04blah, blah, blah, with the COM hijacking
11:06implementation in creating a planned
11:08task for maintained access, persistent
11:11capability, and more code execution in
11:14the future. That ends up terminating and
11:16restarting Explorer, like your whole
11:18Windows desktop environment, which will
11:20then, thanks to the COM hijacking
11:22trigger, ensure this all again. Or,
11:25okay, that's the actual execution of it.
11:27That launches the Covenant software a
11:30I'm not positive and I would be curious
11:32if that's like open source Covenant C2
11:34for command and control, but it's
11:35interesting that uses legitimate file
11:37and cloud storage file and .io uses that
11:41for like C2 infrastructure for
11:43management and command and control.
11:44Apparently, Covenant is often times used
11:47by UAC 0001 or has Ukraine refers to
11:51APT28 Russia. And this file and .io as
11:55some other online resource that they're
11:57leveraging and taking advantage of for
11:59command and control or just hosting and
12:01managing their infrastructure is maybe
12:03something that you weren't tracking
12:04before could be added to a list of maybe
12:06a network block if a low list makes
12:08sense for you, but this is another sweet
12:11living off of trusted sites technique
12:13where some external infrastructure lets
12:15a bad actor do even more damage. I'm
12:17sure it has, of course, a genuine
12:18purpose legitimately used, but being
12:20leveraged in this attack chain. Now, I
12:22think the neat stuff here kind of as
12:24part of the specific vulnerability, like
12:26when we see the chain that they used to
12:29now execute, I presume a blank {dot}
12:32doc. They see the exact same sketchy
12:35strange URL or WebDAV link for blank
12:38{dot} doc. So, I just don't see a
12:40specific shot 256 hash for blank {dot}
12:42doc, but obviously that infrastructure
12:43right now is down. I can't pull down
12:45that file. I would be super curious
12:47though what is in that LNK file, like
12:50what was the actual target? But look at
12:51their wild graph here. Yeah, this
12:53bulletin H Microsoft Word document that
12:55leverages and packages this technique
12:57references the document {dot} doc. Oh
12:59oh, that's inside of blank {dot} doc,
13:02and they do this like multiple different
13:04chains. That's kind of wild, and it
13:06stages and pulls through a lot of this.
13:08Aha, task you can see barely here the
13:11execution to get the one drive health
13:13code running. Wild. The real question
13:16though is how come and why is this {dot}
13:20LNK file or Windows shortcut file
13:22actually being executed from the call of
13:25this rich text file format rtf.doc
13:29security bypass OLE object linking and
13:31embedding technique. Well, the
13:33mitigation section of MSRC, the
13:35Microsoft Resource Center, is walking
13:37you through a process to actually block
13:39some registry keys. And specifically,
13:42they're talking about COM or the
13:43Component Object Model with these
13:45specific CLSIDs for EAB22AC3,
13:50blah blah blah. And that is actually the
13:54correlating ID number for ShellExecute,
13:57from what I understand. Like that is
13:59what will actually fire or run or start
14:01a process. That's what it is. It's
14:03called a Shell Explorer, forgive me. So,
14:06I was looking into this, doing a little
14:07bit more research, and I saw Decalage,
14:09forgive me, Philip Philip, I'm so sorry,
14:11you know I'm going to get the name wrong
14:12as I always do. I can't pronounce
14:14anything. He put out a really cool
14:15script just a little bit ago, regular
14:17Python code, as he has always been
14:19building out the OLE tools or OLE VBA or
14:22even I think ViperMonkey to look through
14:24stuff in strange doc Microsoft Office
14:26documents. But he notes, "Hey, this
14:28script will scan Microsoft Office files
14:30to look for that OLE object that could
14:33match this specific CVE." It uses his
14:35own OLE tools. According to the
14:38Microsoft advisory, this is related to
14:40the CLSID here, which corresponds to the
14:43shell.explorer COM object, which is used
14:45to open legacy Internet Explorer engine
14:47like Trident or MSHTML data from any
14:50application. So, the real fun thing is
14:53using some of this Python code. And we
14:55can read through it, try to make sense
14:57of what this is. It guesses and
14:58determines if this does have some Word
15:02document zip file, you know, structure
15:04and architecture that includes the XML
15:06that we saw in the parts and pieces of
15:08different themes or resources, etc. But
15:10if it's tracking some of the OLE objects
15:13that reference the class ID here,
15:15referring to shell.explorer, there's
15:17just a gentle little heads-up, "Hey, you
15:19know what? This may be related to the
15:22current zero-day that we see Russia
15:23exploiting right now. And what do you
15:25think? If we were to just run this
15:27thing, obviously pretty clearly it's
15:29going to show, "Oh, yeah, the malicious
15:31sample that we've got here in our
15:33current directory, bulletin_h.doc
15:36from Russia." Let me hop in the OLE
15:38check directory. Let me try and run the
15:40OLE check script that has been provided.
15:42We will need to give it an argument, so
15:44I'll give it the bulletin_h.doc
15:47file.
15:48And yeah.
15:50Tracking down RTF,
15:52finds the OLE object with the
15:53appropriate CLSID, knowing that's going
15:56to be using probably Shell Explorer, and
15:58it executes the .lnk file from that
16:00weird WebDAV URL. It's going to be a hit
16:03for CVE-2026-21509.
16:05Hmm.
16:07Hey, all these registry tweaks are just
16:09kind of a mitigation, right? Obviously,
16:11the real solution is to patch, is to
16:13update. If you're using, I guess, later
16:15versions, Office 2021 are automatically
16:17protected without doing that whole
16:18dance, but uh just patch, just update,
16:21right? You know, patch your potatoes.
16:23But that's it. That's the video. I
16:24didn't want to fall off a cliff on all
16:25the malware analysis because I don't
16:27think we had all the SHA-256 hashes to
16:29track down those indicators of
16:30compromise from VirusTotal, but I did
16:32want to showcase a little bit of, "Look,
16:34hey, doing some of that research,
16:35reading those write-ups, tracking to see
16:36what tools are available, what are folks
16:38talking about, how are threat actors
16:40talking about this, if they are?" And
16:42with that, hey, please do give Flare
16:43some love, link in the video
16:44description. Thanks so much for watching
16:45this video. Please do all the YouTube
16:46algorithm things.
16:47Bye.