Microsoft Security Blog: Marbled Dust leverages zero-day in Output Messenger for regional espionage

May 12, 2025

—

Source URL: https://www.microsoft.com/en-us/security/blog/2025/05/12/marbled-dust-leverages-zero-day-in-output-messenger-for-regional-espionage/
Source: Microsoft Security Blog
Title: Marbled Dust leverages zero-day in Output Messenger for regional espionage

Feedly Summary: Since April 2024, the threat actor that Microsoft Threat Intelligence tracks as Marbled Dust has been observed exploiting user accounts that have not applied fixes to a zero-day vulnerability (CVE-2025-27920) in the messaging app Output Messenger, a multiplatform chat software. These exploits have resulted in collection of related user data from targets in Iraq. Microsoft […]
The post Marbled Dust leverages zero-day in Output Messenger for regional espionage appeared first on Microsoft Security Blog.

AI Summary and Description: Yes

Summary: The Microsoft Threat Intelligence blog post discusses the Marbled Dust threat actor exploiting a zero-day vulnerability in Output Messenger, a messaging application, to conduct espionage primarily targeting Kurdish military entities in Iraq. The article outlines the exploitation process, attack chain, mitigation strategies, and recommended protective measures for organizations.

Detailed Description: The blog provides a detailed analysis of the Marbled Dust threat actor’s activities, focusing on a critical zero-day vulnerability (CVE-2025-27920) affecting the Output Messenger application. This information is vital for security professionals seeking to understand recent threats and protect their infrastructure.

Key points include:

– **Zero-Day Exploitation**: The threat actor exploited a vulnerability that allowed them to upload malicious files into the server’s startup directory, highlighting the risks associated with unpatched software and the importance of applying security updates swiftly.

– **Tactical Shift**: The use of a zero-day exploit indicates an escalation in Marbled Dust’s operational capabilities and suggests that their threat landscape is evolving, possibly increasing the urgency of their espionage agendas.

– **Attack Chain**:
– The sequence begins with obtaining user credentials, likely via DNS hijacking.
– Once authenticated, malicious files are uploaded to the Output Messenger server.
– This allows the actor to gain indiscriminate access to user communications and sensitive data.

– **Mitigation Strategies**: Microsoft provides a series of recommendations to protect against such threats, which include:
– Ensuring that Output Messenger is updated to patched versions.
– Turning on cloud-delivered protection in antivirus tools.
– Utilizing vulnerability management systems to continually monitor and remediate vulnerabilities.
– Implementing Conditional Access authentication and encouraging safe browsing practices.

– **Indicators of Compromise**: The blog outlines specific indicators related to the threat activity, such as domains and file hashes associated with the Marbled Dust operations.

– **Defense Mechanisms**: Strengthening Microsoft Defender configurations and employing advanced threat detection tools like Microsoft Defender XDR are recommended to identify and remediate threats.

By understanding these insights, security professionals can better prepare their environments against similar exploitation attempts, ensuring both compliance and data protection.

1 2 2024 2025 24 4 5 7 a access account Act advanced threat detection AGI AI analysis and anti antivirus app Application art as attack attack chain authentication Bi by C capabilities chain chat CI CIA Cloud co Col communication compliance Condi conditional access Conditional Access authentication Configuration configurations credential credentials critical CVE D data Data Protection day day exploit day vulnerability de Defender defense defense mechanism defense mechanisms delivered protection detection detection tools DNS domain domains e end environment espionage exp exploit Exploitation exploits file first fixes for g Gen H high Highlight hijacking HR http HTTPS in indicators of compromise information infrastructure insights Intel intelligence Iraq Iron IRS ite J jack k Key l land led Li low M malicious files man management Management System Marbled Dust measures media messaging messaging app Messenger Micro Microsoft Microsoft Defender Microsoft Security Microsoft Security Blog Microsoft Threat Intelligence Mila military mitigation mitigation strategies Monitor multi N no o of on operation operational capabilities operations organization organizations ory out output Output Messenger Patch platform point post pre process professionals protection protective measures Q R rack rag rate RCE recommendations red Region Risk risks Ro RoT s safe Safe Browsing sec security security professionals security update security updates sensitive data sequence series server shift Sig Sim SoC software source specific SSE SSO start startup strategies Swift system systems T the threat threat actor threat detection Threat Detection Tools threat intel threat intelligence threat landscape threats to tool tools Tor TP turn under up update updates US use user user credentials user data uth V version vulnerabilities vulnerability Vulnerability Management Ware Wi x zero zero-day zero-day exploit zero-day exploitation zero-day vulnerability