abc1230940/soc336-windows-ole-zero-click-rce-exploitation-detected-cve-2025-21298SOC336 - Windows OLE Zero-Click RCE Exploitation Detected (CVE-2025-21298) Walkthrough
One of our employees Austin received a phishing email from a suspicious sender and an alert was triggered after he opened the email using Outlook At Feb, 04, 2025, 04:18 PM. The trigger reason was "Malicious RTF attachment identified with known CVE-2025-21298 exploit pattern" .
EventID : 314
Event Time : Feb, 04, 2025, 04:18 PM (I think it was wrong)
Rule : SOC336 - Windows OLE Zero-Click RCE Exploitation Detected (CVE-2025-21298)
Level : Security Analyst
SMTP Address : 84.38.130.118
Source Address : [email protected]
Destination Address : [email protected]
E-mail Subject : Important: Action Required for Upcoming Project Deadline
Attachment : mail.rtf
Attachment Hash : df993d037cdb77a435d6993a37e7750dbbb16b2df64916499845b56aa9194184
Device Action : Allowed
Trigger Reason : Malicious RTF attachment identified with known CVE-2025-21298 exploit pattern.
Let's dig into the Email Security, Log Management and Endpoint Security Log for the alert triage.
I searched the sender address projectmanagement@pm[.]me and clicked the email "Important: Action Required for Upcoming Project Deadline" sent at 05:12 AM on the same day, which was weird to me because the urgent tones and wordings like "Important" and "Action Required" gave me an insight of a phishing email.
I searched the domain pm[.]me on VirusTotal and only 1 vendor decided it as suspcious.
However, when I searched the SMTP Address 84[.]38[.]130[.]118, 7 vendors flagged it as Malicious and Malware and it was related to SILVER C2 server.
84[.]38[.]130[.]118 was also found in AbuseIPDB database. It locates at Riga, Riga, Latvia, belongs to the domain name rixhost.lv and categorized as DDoS Attack, Hacking and Exploited Host.
Finally I searched the hash df993d037cdb77a435d6993a37e7750dbbb16b2df64916499845b56aa9194184 of the attachment mail.rtf on VirusTotal and 29 out of 61 vendors flagged the attachment as Malicious. It belongs to the malware family rtfmalformb and it was associated with the vulnerability CVE-2025-21298.
It was confirmed that a phishing email with a malicious attachment was sent to Austin.
