MSDT abused to achieve RCE on Microsoft Office

This report documents active exploitation of CVE-2022-30190 (aka Follina) in which crafted DOCX and RTF files use MSHTML and the ms-msdt URI scheme to invoke msdt.exe with an IT_BrowseForFile argument that results in arbitrary PowerShell execution. The authors enumerate malicious document and loader hashes, IPs and domains, a retrieved PyInstaller loader that fetches a Cobalt Strike beacon, detection indicators (process execution pattern, YARA and Sigma rules), suggested GPO/registry mitigations, and note multiple unrelated samples observed in the wild suggesting reuse or repurposing by different actors.