Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
To recap, the KaiXin Exploit Pack has the following exploits: CVE-2012-0507 - Java Atomic
To recap, the KaiXin Exploit Pack has the following exploits: CVE-2011-3544 - Java Rhino
To recap, the KaiXin Exploit Pack has the following exploits: CVE-2012-1723 - Java Applet Field
To recap, the KaiXin Exploit Pack has the following exploits: CVE-2012-1889 - MS XML Core
To recap, the KaiXin Exploit Pack has the following exploits: CVE-2012-0754 - Flash MP4
2 distinct techniques documented for this family, organized by ATT&CK tactic.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Detection names shown in the IOC table for the batch file and Docker.exe tool; not the primary malware discussed.
A file-infector malware mentioned as an additional dropped component found in the infection chain on compromised systems.
A virulent, polymorphic file infector dropped by the KaiXin Exploit Pack after successful exploitation.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.