Microsoft recently released a security advisory regarding an actively exploited critical remote code execution vulnerability in Microsoft Entra ID that is caused by the deserialization of untrusted data. The vulnerability is allowing unauthenticated attackers to execute malicious code over a network.

Through this blog, we will understand what the critical vulnerability in Microsoft Entra ID is about, the threat it poses, and what organizations can do to defend against it.

About the threat

The campaign was first identified following an infection at a Central Asian government organization in October 2025.

It uses multiple techniques:

• Spear phishing – Attackers deliver malicious documents to targeted users, usually password-protected RAR archives.
• DLL Sideloading – Malicious DLLs are loaded through legit apps, making malware look like it is run by a trusted program.
• Google Drive C2 – DriveSilkRAT uses Google Drive to communicate with infected systems. Attackers can send commands and receive results on Google Drive without looking like suspicious cloud activity.
• WMI Execution – The malware uses a built-in tool called WMI to start a program or run commands on a compromised system, allowing attackers to perform actions without using a separate tool.

How does it impact government organizations in Central Asia?

The biggest security concern for organizations is that the campaign uses multiple RATs that are tailored to camouflage their presence.

Security researchers at Bitdefender have described the toolset as small and modular, with components loading in the memory and command-and-control using Google Drive.

Attackers are also using legit applications to load malicious code, making traditional malware detection mechanisms ineffective.

An attacker who has successfully launched an attack can:

• Maintain persistent access remotely
• Steal sensitive government and organizational information
• Monitor activity on compromised systems
• Execute commands remotely
• Move deeper into the victim’s network
• Exfiltrate intelligence without raising alarms

Detection opportunities

Organizations should focus on behavioral detection, particularly:

• Unusual Google Drive activity from endpoints that do not normally use the service.
• Unexpected access to shared Google Drive locations.
• Repeated or unusual cloud-file polling patterns.
• Legitimate applications loading unexpected or unsigned DLLs.
• Suspicious Office document-to-process execution chains.
• Unusual WMI-based process creation.
• Suspicious scheduled-task or other persistence activity.
• Password-protected RAR attachments received through unexpected emails.

SharkStriker’s recommendations

• Monitor Google Drive activity for unusual C2-like behavior rather than automatically treating Google traffic as trusted.
• Review suspicious or unexpected password-protected RAR attachments.
• Monitor legitimate applications for abnormal DLL loading.
• Monitor WMI-based process execution and unusual parent-child process relationships.
• Hunt for the reported SilkParasite and DriveSilkRAT indicators where applicable.
• Correlate endpoint and cloud-service activity to identify suspicious communication patterns.
• Include Living Off Trusted Services techniques in threat-hunting and detection strategies.