MalwareExploits 2 CVEs

Bottle exploit kit

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2018-8174Double Kill

Another researcher later discovered the custom exploit kit, which was named the Bottle Exploit Kit (BottleEK). It exploits CVE-2018-15982, a Flash Player use after free vulnerability, as well as CVE-2018-8174, a VBScript remote code execution vulnerability.

via trendmicro documentsdocuments.trendmicro.com

CVE-2018-15982Adobe Flash Player Use-After-Free Remote Code Execution

via trendmicro documentsdocuments.trendmicro.com

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1189Drive-by CompromiseEvidence1

By using a custom exploit kit to deliver malware via malvertising

T1190Exploit Public-Facing ApplicationEvidence2

It exploits CVE-2018-15982, a Flash Player use after free vulnerability, as well as CVE-2018-8174, a VBScript remote code execution vulnerability.

Execution

1 technique

T1059.007JavaScriptEvidence1

A screengrab of code showing the BottleEK script checking the infected device’s browser language and browser version

Stealth

1 technique

T1027Obfuscated Files or InformationEvidence1

Each of Cinobi’s four stages contains an encrypted position-independent shellcode that makes analysis slightly more complicated.

Credential Access

1 technique

T1539Steal Web Session CookieEvidence1

Check if the browser cookie “username” has been set. If it’s set, it will not perform any action. Otherwise, it will set a “username” cookie with the value “bingv” and continue the infection.

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

Check the version of Internet Explorer, Adobe Flash Player, and the architecture of the infected machine. It then sends the gathered information with an Ajax request to the exploit kit hosting server

T1614.001System Language DiscoveryEvidence1

Check if the browser is Internet Explorer and if the browser language is set to Japanese. If not, it will stop the infection.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

After successful exploitation, it will load the malware from the URL “/conn[.]php?ge=1” and execute it.

INDICATORS OF COMPROMISE

IOCs tracked for this family

8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app—

hash.sha256●●●●●●●●●●●●View more in app—

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

ntt security japanNews

Mar 10, 2021

日本を標的としたPseudoGateキャンペーンによるSpelevo Exploit Kitを用いた攻撃について | セキュリティナレッジ | NTTセキュリティ・ジャパン株式会社

Separate exploit kit mentioned as background on Japan-targeted drive-by download activity.

trendmicro documentsNews

Aug 14, 2026

A custom exploit kit used in Operation Overtrap to deliver Cinobi, primarily targeting Japanese users on Internet Explorer with Japanese language settings. It fingerprints victims, uses anti-crawl cookie checks, and serves exploits for Flash and VBScript vulnerabilities before loading the malware payload.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching8

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 2 CVEs

Bottle exploit kit

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2018-8174Double Kill

via trendmicro documentsdocuments.trendmicro.com

CVE-2018-15982Adobe Flash Player Use-After-Free Remote Code Execution

via trendmicro documentsdocuments.trendmicro.com

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1189Drive-by CompromiseEvidence1

By using a custom exploit kit to deliver malware via malvertising

T1190Exploit Public-Facing ApplicationEvidence2

It exploits CVE-2018-15982, a Flash Player use after free vulnerability, as well as CVE-2018-8174, a VBScript remote code execution vulnerability.

Execution

1 technique

T1059.007JavaScriptEvidence1

A screengrab of code showing the BottleEK script checking the infected device’s browser language and browser version

Stealth

1 technique

T1027Obfuscated Files or InformationEvidence1

Each of Cinobi’s four stages contains an encrypted position-independent shellcode that makes analysis slightly more complicated.

Credential Access

1 technique

T1539Steal Web Session CookieEvidence1

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

Check the version of Internet Explorer, Adobe Flash Player, and the architecture of the infected machine. It then sends the gathered information with an Ajax request to the exploit kit hosting server

T1614.001System Language DiscoveryEvidence1

Check if the browser is Internet Explorer and if the browser language is set to Japanese. If not, it will stop the infection.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

After successful exploitation, it will load the malware from the URL “/conn[.]php?ge=1” and execute it.

INDICATORS OF COMPROMISE

IOCs tracked for this family

8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app—

hash.sha256●●●●●●●●●●●●View more in app—

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

ntt security japanNews

Mar 10, 2021

日本を標的としたPseudoGateキャンペーンによるSpelevo Exploit Kitを用いた攻撃について | セキュリティナレッジ | NTTセキュリティ・ジャパン株式会社

Separate exploit kit mentioned as background on Japan-targeted drive-by download activity.

trendmicro documentsNews

Aug 14, 2026

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching8

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.