The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Follina is the name commonly used for CVE-2022-30190, a vulnerability in the Microsoft Support Diagnostic Tool (MSDT) in Windows. In May 2022, CISA reported that Microsoft had observed active exploitation. Subsequent reporting documented attackers using Follina in campaigns that delivered Qbot/Qakbot; that evidence describes activity from 2022, not the vulnerability’s prevalence today.
What was the Follina vulnerability?
CVE-2022-30190 affected MSDT, a Windows tool used to gather diagnostic information. The Canadian Centre for Cyber Security assigned it a CVSS score of 7.8 out of 10 and said exploitation could allow arbitrary code execution. CISA’s May 31, 2022 notice said a remote, unauthenticated attacker could take control of an affected system. That describes potential impact on a vulnerable system; it does not mean every such system was compromised.
In that May 31 notice, CISA urged users and administrators to review Microsoft’s guidance and apply the necessary workaround. CISA’s alert records the active-exploitation warning and contemporaneous advice.
How did Follina deliver Qbot?
Follina was one link in an infection chain, rather than the name of the malware delivered. Campaign reports describe phishing messages carrying malicious Word documents that used the vulnerability to initiate execution, followed by Qbot/Qakbot activity.
#1 Best Overall
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
UNC2633 activity observed by Google Cloud
Google Cloud Threat Intelligence’s 2023 review of 2022 zero-day exploitation says it observed UNC2633 exploiting CVE-2022-30190 in at least three instances in early June 2022, before the patch. At least two of those observed instances distributed QAKBOT. Those are counts of that team’s observations—not an estimate of all attacks or victims. Google Cloud’s retrospective provides that campaign detail.
A phishing-document chain described by KPMG
KPMG’s November 9, 2022 notification describes a phishing email with a malicious Word document weaponized with Follina, followed by a Qbot infection chain. KPMG characterizes Qbot as capable of reconnaissance, lateral movement, data exfiltration, and delivering additional payloads. Those are capabilities attributed by the report, not outcomes established for every infection. KPMG’s notification documents this specific campaign.
Rank #2
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Other threat activity and ransomware context
Microsoft reported that threat actor DEV-0464 rapidly adopted CVE-2022-30190 in its campaigns. In the same broader article, Microsoft describes Qakbot’s wide distribution and discusses ransomware handoffs. This provides threat context, but does not establish that every Follina attack—or every Qbot infection—led to ransomware. Microsoft’s Security Blog discusses the actor and broader malware context.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →When was Follina patched?
The Canadian Centre for Cyber Security says Microsoft released a patch on June 14, 2022, in its June Security Updates. The response therefore had two stages: workaround guidance while a patch was not yet available, then the security update. The Centre’s advisory reports the 7.8 score, patch date, and mitigation guidance.
Rank #3
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few clicks, and your info stays protected on public Wi-Fi every time you connect.
- PERSONAL DATA SCANS – Take your info off the market. We’ll find your personal information on sites selling it, then guide you on how to remove it.
- SOCIAL PRIVACY MANAGER – Decide what you share. McAfee finds the privacy settings buried in your social accounts and fixes them.
- Update available: Apply the security update appropriate to the Windows product and installation.
- Unable to patch immediately: Follow Microsoft’s mitigations for the affected system. The Canadian advisory specifically mentions disabling the MSDT URL protocol as a mitigation.
- Checking a device now: Confirm its actual Windows update status and consult current Microsoft guidance for that product. A 2022 campaign report cannot determine whether a particular device is patched or establish present-day exploitation frequency.
What the campaign reports do—and do not—show
The reports establish that Follina was actively exploited in 2022 and that Qbot/Qakbot was delivered in documented cases. They do not establish a reliable overall victim count, how common exploitation was across all attacks, or the current status of any Windows device. The “at least three” figure refers only to Google Cloud’s early-June observations, and “at least two” of those instances distributed QAKBOT.
Quick Recap
Best Value
![Malwarebytes Standard, Premium Security| Amazon Exclusive | 18 Months, 2 Devices | Windows, Mac OS, Android, Apple iOS, Chrome [Online Code]](https://m.media-amazon.com/images/I/41LbYnawq9L._SL160_.jpg)
- AWARD WINNING Antivirus, anti-malware, anti-spyware & more
- 24/7 REAL TIME PROTECTION against emerging malware threats, including ransomware and viruses- without slowing you down.
- PROTECTS YOUR DEVICES ON MULTIPLE PLATFORMS: Get cyber protection for your computers, smartphones, or tablets- Compatible with Windows, Mac, Android, iOS
- DOWNLOAD AND INSTALL INSTANTLY
- UNMATCHED THREAT DETECTION: We found malware on 40 percent of devices that already had a third-party antivirus installed.
Rank #4
![Norton 360 Platinum 2027 Antivirus, 20 Devices, 3 Months Free [Download]](https://m.media-amazon.com/images/I/51kAiFhngDL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 20 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
