--- title: “Follina” MSDT Attack Zero-Day Threat description: A zero-day attack has emerged executed remotely through the Microsoft Diagnostics Tool (MSDT) and Microsoft Office utilities, namely Microsoft Word. --- [Skip to content](https://blog.yournucleus.ca/follina-msdt#main-content) [![Nuc-logo-sketched-1 (1)](https://blog.yournucleus.ca/hs-fs/hubfs/nucleus-images/Nuc-logo-sketched-1%20(1).png?width=220&height=44&name=Nuc-logo-sketched-1%20(1).png "Nuc-logo-sketched-1 (1)")](https://yournucleus.ca) - About Show submenu for About ![](https://blog.yournucleus.ca/hubfs/nucleus-images/caret.png) - [About Nucleus](https://yournucleus.ca/about/) - [Careers](https://yournucleus.ca/careers/) - [History](https://yournucleus.ca/about/history/) - [Team](https://yournucleus.ca/about/team/) - Services Show submenu for Services ![](https://blog.yournucleus.ca/hubfs/nucleus-images/caret.png) - [Managed IT Support](https://yournucleus.ca/services/managed-it-support/) - [Cybersecurity Services](https://yournucleus.ca/services/cybersecurity-services/) - [Managed AI Solutions](https://yournucleus.ca/services/managed-ai-solutions/) - [IT Consulting](https://yournucleus.ca/services/it-consulting/) - [Microsoft 365](https://yournucleus.ca/services/microsoft-365/) - [vCIO](https://yournucleus.ca/services/vcio/) - [ALL](https://yournucleus.ca/services/) - Results Show submenu for Results ![](https://blog.yournucleus.ca/hubfs/nucleus-images/caret.png) - [Architecture](https://yournucleus.ca/results/architecture-engineering-construction/) - [Legal](https://yournucleus.ca/results/legal/) - [Mining](https://yournucleus.ca/results/mining/) - [All](https://yournucleus.ca/results/) - [Blog](https://blog.yournucleus.ca) - About Show submenu for About ![](https://blog.yournucleus.ca/hubfs/nucleus-images/caret.png) - [About Nucleus](https://yournucleus.ca/about/) - [Careers](https://yournucleus.ca/careers/) - [History](https://yournucleus.ca/about/history/) - [Team](https://yournucleus.ca/about/team/) - Services Show submenu for Services ![](https://blog.yournucleus.ca/hubfs/nucleus-images/caret.png) - [Managed IT Support](https://yournucleus.ca/services/managed-it-support/) - [Cybersecurity Services](https://yournucleus.ca/services/cybersecurity-services/) - [Managed AI Solutions](https://yournucleus.ca/services/managed-ai-solutions/) - [IT Consulting](https://yournucleus.ca/services/it-consulting/) - [Microsoft 365](https://yournucleus.ca/services/microsoft-365/) - [vCIO](https://yournucleus.ca/services/vcio/) - [ALL](https://yournucleus.ca/services/) - Results Show submenu for Results ![](https://blog.yournucleus.ca/hubfs/nucleus-images/caret.png) - [Architecture](https://yournucleus.ca/results/architecture-engineering-construction/) - [Legal](https://yournucleus.ca/results/legal/) - [Mining](https://yournucleus.ca/results/mining/) - [All](https://yournucleus.ca/results/) - [Blog](https://blog.yournucleus.ca) [Contact](https://yournucleus.ca/contact/) [1-844-301-HELP](tel:1-844-301-4357) # “Follina” MSDT Attack Zero-Day Threat May 31, 2022   |  [Security](https://blog.yournucleus.ca/tag/security) A zero-day attack has emerged that currently has no patch available. The code is executed remotely through the Microsoft Diagnostics Tool (MSDT) and Microsoft Office utilities, namely Microsoft Word.  This type of threat is known as remote code execution (RCE), which means that once this code is detonated, threat actors can elevate their own privileges and potentially gain full control over the affected environment. The attacker can install programs, view, change, or delete data, or create new accounts if allowed by the user’s rights. Detonating this malicious code is as simple as opening up a Word doc — **in preview mode.** The mitigations that are available have not yet been thoroughly reviewed by the IT industry. These workarounds involve changing settings in the Windows Registry which could have serious ramifications as an incorrect Registry entry could“brick your machine” making it unusable. We ask all businesses to take extreme vigilance – do not open or click on any links that you are not expecting and in this case, Microsoft 365 documents from sources you were not anticipating to receive attachments from. Even when the sender is known, be very cautious before opening any attachments.  Ask yourself – was this email expected? The team at Nucleus is actively monitoring this vulnerability and the mitigation of it. Clients using our new [Managed IT Security Services](https://yournucleus.ca/services/cybersecurity-services/) are protected against this threat. If you are concerned about this attack or your businesses’ cybersecurity defence, please [contact us.](https://yournucleus.ca/contact/)  Resources [Microsoft Security Response Centre](https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/) [Huntress](https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug)   ![Nucleus Pulse Image](https://blog.yournucleus.ca/hubfs/nucleus-images/Group%20399.png) ![Picture of Nucleus Networks](https://blog.yournucleus.ca/hs-fs/hubfs/nucleus-images/nuc_dog.png?width=115&name=nuc_dog.png) [Nucleus Networks](https://blog.yournucleus.ca/author/nucleus-networks) ## We are local! WE HAVE PRESENCE IN VICTORIA, VANCOUVER, PRINCE GEORGE, CALGARY, AND TORONTO. [Victoria](https://yournucleus.ca/victoria/) [Vancouver](https://yournucleus.ca/vancouver/) [Calgary](https://yournucleus.ca/calgary/) [Toronto](https://yournucleus.ca/toronto/) [Prince George](https://yournucleus.ca/prince-george/) ## Ready to take your business to the next level? [Get Started](https://yournucleus.ca/contact/) ![pulse animation](https://blog.yournucleus.ca/hs-fs/hubfs/nucleus-images/pulse-animation.gif?width=806&height=61&name=pulse-animation.gif) ![Nucleus-Networks-Managed-IT-Services-Provider-REV-Logo](https://blog.yournucleus.ca/hubfs/nucleus-images/Nucleus-Networks-Managed-IT-Services-Provider-REV-Logo.png "Nucleus-Networks-Managed-IT-Services-Provider-REV-Logo") ![Apple-and-Microsoft-Office-Ready](https://blog.yournucleus.ca/hubfs/nucleus-images/Apple-and-Microsoft-Office-Ready.png "Apple-and-Microsoft-Office-Ready") **FRIENDLY** [twitter](https://www.twitter.com) [facebook](https://www.facebook.com) [linkedin](https://www.linkedin.com) [instagram](https://www.instagram.com) ### ABOUT - [History](https://yournucleus.ca/about/history/) - [Careers](https://yournucleus.ca/careers/) - [Our Team](https://yournucleus.ca/about/team/) - [Blog](https://blog.yournucleus.ca/) ### SERVICES - [IT Support](https://yournucleus.ca/services/managed-it-support/) - [Cybersecurity](https://yournucleus.ca/services/cybersecurity-services/) - [vCIO Services](https://yournucleus.ca/services/vcio/) - [Cloud Services](https://yournucleus.ca/services/cloud-services/) - [Microsoft 365](https://yournucleus.ca/services/microsoft-365/) - [IT Consulting](https://yournucleus.ca/services/it-consulting/) - [Managed Voice](https://yournucleus.ca/services/managed-voice-services/) ### CONTACT US - 1 844 301 4357 - [sales@yournucleus.ca](mailto:sales@yournucleus.ca) - [help@yournucleus.ca](mailto:help@yournucleus.ca) - careers@yournucleus.ca ### LOCATIONS - VANCOUVER 880 – 505 Burrard St. [+1 604 682 3444](tel:%20+1-604-682-3444) - VICTORIA [+1 844 301 4357](tel:%20+1-844-301-4357) - CALGARY [+1 587 393 1141](tel:%20+1-587-393-1141) - TORONTO [+1 416 628 3718](tel:%20+1-416-628-3718) © 2023 NUCLEUS  |  [TERMS OF USE](https://yournucleus.ca/terms-of-use/)  |  [PRIVACY POLICY](https://yournucleus.ca/privacy-policy/)  |  POWERED BY LOOMO ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Nucleus Networks", "url" : "https://blog.yournucleus.ca/author/nucleus-networks" }, "dateModified" : "2025-05-15T10:19:49.623Z", "datePublished" : "2022-05-31T17:51:33.000Z", "headline" : "“Follina” MSDT Attack Zero-Day Threat", "mainEntityOfPage" : { "@id" : "https://blog.yournucleus.ca/follina-msdt", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.yournucleus.ca/hubfs/Illustrated%20Logo.png" }, "name" : "Nucleus Networks Inc." } } ```