Türkiye-linked spy crew exploited a messaging app zero-day to snoop on Kurdish army in Iraq – Source: go.theregister.com

Turkish spies exploited a zero-day bug in a messaging app to collect info on the Kurdish army in Iraq, according to Microsoft, which says the attacks began more than a year ago.

Specifically, the snoops abused CVE-2025-27920, a directory traversal vulnerability in version 2.0.62 of messaging app Output Messenger, and the intrusions began in April 2024. The app’s developer Srimax issued a software update in December to patch the hole, however not all users applied the fixes.

The crew behind the intrusions, a Türkiye-affiliated espionage threat actor that Microsoft tracks as Marbled Dust, abused the flaw to steal user data belonging to the Kurdish military in Iraq, Redmond’s threat intelligence team wrote on Monday.

Srimax admitted to the flaw and published a security advisory in which it revealed “Attackers could access files such as configuration files, sensitive user data, or even source code, and depending on the file contents, this could lead to further exploitation, including remote code execution.”

Srimax did not immediately respond to The Register‘s inquiries.

Marbled Dust, aka Sea Turtle

Marbled Dust typically targets government institutions and organizations whose interests run counter to those of the Turkish government. Its activities overlap with threat groups tracked by other security researchers as Sea Turtle and UNC1326.

In earlier campaigns, Marbled Dust’s operatives scanned targeted infrastructure for known bugs in internet-facing appliances or apps, then abused these vulnerabilities to gain initial access. The crew also used compromised DNS registries and/or registrars to reset the DNS server configuration of government orgs to intercept traffic and steal credentials.

Microsoft says Marbled Dust’s successful use of the zero-day flaw in Output Messenger is a new behavior. This suggests that the crew has become more technically sophisticated, or “could also suggest that Marbled Dust’s targeting priorities have escalated or that their operational goals have become more urgent,” Redmond warned.

Output Messenger is commercial software and includes software that includes a client and a server app. In these new attacks against the Kurdish army, the spies somehow gained access to an app that runs on the server, The Output Messenger Server Manager, as an authenticated user.

“While we currently do not have visibility into how Marbled Dust gained authentication in each instance, we assess that the threat actor leverages DNS hijacking or typo-squatted domains to intercept, log, and reuse credentials,” Microsoft’s threat hunters opined.

• Never mind Russia: Turkey and Vietnam are Microsoft’s new state-backed hacker threats du jour
• Microsoft names alleged credential-snatching ‘Azure Abuse Enterprise’ operators
• Homeland Security boss says CISA has gone off the rails, vows to set it right
• China now America’s number one cyber threat – US must get up to speed

Once Marbled Dust’s hackers access stolen credentials, they exploit CVE-2025-27920 to drop malicious files named OM.vbs and OMServerService.vbs, to the Output Messenger server startup folder. They also send another malicious executable, OMServerService.exe, to the server’s Users/public/videos directory.

Marbled Dust then uses OMServerService.vbs to call OM.vbs, which the malware passes to OMServerService.exe as an argument.

While Microsoft says it couldn’t analyze OM.vbs, its threat intel team notes that OMServerService.exe is a backdoor written in Go and cleverly disguised as the legitimate file with the same name. “In some cases, OMServerService.exe is observed connecting to a hardcoded domain, api.wordinfos[.]com, for data exfiltration,” the researchers wrote.

The attack also infects Windows clients. On the client side, the installer extracts and executes both the legitimate OutputMessenger.exe and another backdoor written in Go, OMClientService.exe. The latter connects to a Marbled Dust command-and-control (C2) domain, and in at least one case the victim device connected to an IP address linked to the group, “likely for data exfiltration, as these connections coincide with the threat actor issuing commands to collect files with varying file extensions to a RAR file on the desktop,” according to Microsoft.

Both Srimax and Microsoft urge users to upgrade to Output Messenger version V2.0.63 to prevent miscreants from exploiting this bug. ®