Technical intelligence and weaponization dossier for CVE-2022-30190. Documented exploitation across 6 active malware families totaling 2,857 analyzed telemetry samples.
| Vulnerability ID | CVE-2022-30190 |
|---|---|
| Common Name / Bulletin | Microsoft Windows Support Diagnostic Tool Remote Code Execution (Follina) (ADV220001) |
| CWE Classification | CWE-94: Remote Code Execution via URI Scheme ms-msdt: |
| Affected Software & Versions | Microsoft Windows 7, 8.1, 10, 11, Server 2008 through 2022 |
| Technical Root Cause | MSDT protocol handler (ms-msdt:) invoked from Word documents via external HTML templates allowed execution of PowerShell commands even if macros were disabled, even in Protected View. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 6 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| qbot | Banking Trojan | 1,758 | QakBot (widely referenced as Qbot or Pinkslipbot) is an aggressive, modular banking trojan and malware loader that operated for over 16 years, emerging around 2... |
| pikabot | Loader | 850 | Pikabot is an evasive, modular malware loader that emerged in early 2023, widely recognized by threat intelligence analysts as one of the primary successors to ... |
| icedid | Banking Trojan | 118 | IcedID (widely tracked across the intelligence community as BokBot) is a sophisticated modular banking trojan and initial access loader first identified in Sept... |
| asyncrat | Rat | 95 | AsyncRAT is an open-source remote access trojan (RAT) developed in C# (.NET) that has emerged as one of the most widely deployed commodity backdoors by cybercri... |
| bumblebee | Loader | 35 | Bumblebee is a sophisticated, enterprise-grade modular malware loader first discovered in March 2022 by Google Threat Analysis Group (TAG) and Proofpoint resear... |
| vidar | Infostealer | 1 | Trojan:Win32/Vidar (commercially marketed as Vidar Stealer) is a prolific, commercially available information-stealing trojan first observed on underground Russ... |
Threat intelligence confirms the following adversaries weaponize CVE-2022-30190 in enterprise intrusions and campaign toolkits:
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2022-30190 in enterprise networks:
Process execution: msdt.exe invoked with parameters containing IT_BrowseForFile= or $() PowerShell subexpressions spawned by WINWORD.EXE.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: InfoStealer Protection & Remediation →