Follina in the Wild: TA413, Patch Gaps and Zero-Day Economics

June 13, 2022: With Microsoft’s out-of-band patch for CVE-2022-30190 (the MSDT Follina zero-day, first flagged publicly at the end of May) finally shipped on June 14 — and this window’s final weekend of the patch gap closing — the exploitation-side story was already written: state-actor adoption had moved faster than the vendor’s calendar. Tibetan-dissident-targeting actor TA413 had folded Follina into credential-phishing lures within days of public proof-of-concept; China-nexus espionage groups and commodity infectors had both been observed delivering it via RTF and Word vectors; and the DIY tooling had made it trivially reproducible. This is the companion analysis to our May write-up of the bug itself (the MSDT diagnostic-tooling URI-scheme abuse that let a crafted document achieve code execution with no Office macros involved): what happens when a no-Patch-Tuesday-zero-day meets a multi-week gap, who picked it up — and what the pattern teaches every defender preparing for the next one.

What happened

Our companion piece covered the mechanics: ms-msdt: is a URI scheme that launches Microsoft’s Support Diagnostic Tool, and its parameter surface allowed code execution — meaning any document renderer that follows links (Word, RTF, and later HTML-smuggling variants) could achieve execution without macros, bypassing the Mark-of-the-Web protections users had been trained to trust (the scheme handler launched an OS binary, not sandboxed content). The sample that brought it to light had been sitting in VirusTotal since August 2021 — a recurrence of the “zero-days are older than their disclosure” pattern — but public understanding crystallised May 29–30, 2022, when researchers documented the chain and Microsoft acknowledged investigation.

Then the gap did what gaps do. Within the first week of June, Proofpoint reported TA413 — a Chinese-nexus actor long focused on Tibetan communities — using Follina in credential-phishing campaigns against the Central Tibetan Administration and dissident circles, sandwiched between their traditional custom-loader lures. It was a telling adoption: TA413 is not a top-tier breakout actor, but a patient regional one — and even mid-tier actors had Follina in production within days. Commodity criminal activity followed the usual gradient: RTF-based Follina droppers, builder-tooling integration, and access-broker experimentation through the patch gap. Microsoft’s guidance during the gap (disabling the MSDT troubleshooting pack via registry, then an automated workaround) reduced but did not eliminate exposure, since the URI-scheme surface had several reachable paths.

The out-of-band patch arrived June 14 (Microsoft CVE-2022-30190 fix, shipped the normal June channel) closing the execution path. But the June 13 snapshot — final pre-patch weekend — is the analysts’ artefact: a fully public, weaponised, state-adopted RCE with DIY tooling, against every unpatched Windows box, for sixteen days. It previews everything about modern zero-day economics: PoC-to-weapon in hours, tier-two state adoption in days, commodity in a week, patch in a fortnight.

Exploitation ecosystem at the gap’s close

Follina (CVE-2022-30190) adoption timeline:

  2021-08   first sample sits in VT
            (undetected zero-day dwell)
  2022-05-29/30  public disclosure of chain;
            MS acknowledges; no patch, no
            workaround yet
  2022-06 first week:
            TA413 (Tibetan-targeting,
            China-nexus) credential-phishing
            lures vs dissident orgs  <- state adoption:
                                               days-scale
            China-nexus espionage clusters
            adopt for campaign delivery
  2022-06 gap middle:
            commodity RTF/Word loaders;
            builder-kit integration;
            access-broker trials
  2022-06-13  final pre-patch weekend:
            full public PoC + DIY tooling +
            state + commodity = open season
  2022-06-14  out-of-band June patch ships
            (CVE-2022-30190 fix)

  DEFENDER GAP MITIGATIONS (June 2022):
    disable MSDT URI troubleshooting pack
      (registry workaround)
    ASR rules on Office-child-process spawns
    block ms-msdt: at email gateway/proxy
    hunt: msdt.exe spawns with HTML/
      RTF-parent lineage

Impact and numbers

Timeline

Why it still matters in 2026

Because the shape of the event is now the default. A document-renderer-reachable OS code path, public PoC within a week, tier-two state adoption in days, commodity weaponisation inside a fortnight, and a vendor patch cadence that cannot compress below multi-day for legacy surfaces — that arc repeated across 2023–2026’s URI-scheme, archive-handling, and image-renderer zero-days, and it is the operating assumption behind modern emergency-patching doctrine. Follina specifically contributed two durable lessons. First, attack-surface accounting must include protocol handlers and URI schemes — the dozens of OS-registered custom schemes each represent a code path reachable from untrusted documents and web content, and inventorying/removing unused ones (now standard hardening, formalised in CIS-benchmark-class guidance post-2022) shrinks the class. Second, “no macros” was never “no execution”: the trust boundary users were trained on (enable-macros prompts) did not cover scheme-handler launches, and the 2022-era wave of non-macro execution paths (Follina, DogWalk, the MSDT/ActiveX/COM family) forced defenders to move prompt-level trust decisions down to process-spawn monitoring — ASR rules and parent-child anomaly detection rather than user vigilance. In 2026, with document-driven espionage resurgent and access brokers industrialising PoC-to-access pipelines, Follina’s sixteen-day window reads almost leisurely; the doctrine it forged — hunt for handler spawns, treat URI-scheme surface as attack surface, assume zero-day dwell predates disclosure — is the part that stayed.

Detection and hardening takeaways

• Inventory and disable unused URI-scheme handlers. Post-Follina guidance made this baseline: enumerate registered protocol handlers (per-user and machine), remove or disable those your fleet doesn’t need (ms-msdt joined the 2022-era disable lists), and re-audit after OS updates, which re-register schemes.
• Monitor handler-process spawns, not documents. Follina-class chains are visible at process level: msdt.exe (or any handler binary) spawning from Office/rendering parents with command-line oddities. Detection at spawn-time catches novel variants the way macro-prompt training never could.
• ASR rules and Office hardening as gap insurance. Attack Surface Reduction rules blocking Office-child-process execution blunted Follina during the patch gap; keep them enabled fleet-wide and validate them against current Office versions, since rendering paths drift.
• Treat public PoC as hour-zero for detection engineering. Within days of May 29, defenders had Sigma rules and spawn-signatures for the chain; that speed — not user training — is what limited TA413-class damage. Build the muscle: PoC drops → detection rules → purple-team validation within 72 hours.
• Hunt for pre-disclosure dwell. The August 2021 VT sample proved the exploitation preceded the disclosure. Every fresh zero-day deserves a retrospective hunt: gateway/proxy/endpoint logs back-months for the chain’s IOCs (here: ms-msdt URI strings in documents, handler spawns), because “new” vulnerabilities are usually old campaigns.

FAQ

Why did attackers like Follina more than macros?

Because it bypassed the trust prompt users had been trained on. Macro-based attacks depended on social-engineering a user into clicking “Enable Content”; Follina’s URI-scheme launch needed no such consent — the document or link simply invoked an OS handler that led to execution. Defences built on macro-blocking and user vigilance were blind to it, which is exactly why mid-tier actors like TA413 adopted it within days.

Was Follina ever used at ransomware scale?

Not prominently. Its exploitation profile skewed espionage and credential-access (state-actor phishing, access brokerage) rather than mass ransomware detonation — the delivery chains were document-precision tools, not wormable infrastructure. But its builders appeared in criminal kits during the gap, meaning initial-access brokers offered Follina-based access to whoever wanted it, including later-stage criminal operations.

Are URI-scheme bugs still a thing?

Yes — the class outlived Follina. Windows and third-party applications register custom schemes continuously, and each is a code path reachable from documents, links, and web content; post-2022 disclosures kept arriving (DogWalk in the same season, others since). The durable countermeasure is surface management: know what’s registered, remove what’s unused, monitor spawns for everything else.

What was the actual damage of TA413’s use?

Public reporting focused on the targeting: credential-phishing campaigns against Tibetan dissident organisations and the Central Tibetan Administration community, using Follina chains alongside TA413’s traditional custom loaders. Specific victim counts weren’t disclosed, but the strategic importance was the demonstration — regional-tier state actors weaponising a fresh zero-day against niche communities within days, previewing the compressed windows every defender now plans around.