MalwareExploits 1 CVE

Surtr

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2012-0158MSCOMCTL.OCX ActiveX Controls Remote Code ExecutionExploited in the wild

While the malicious attachments appear to be DOC files due to their file extension, they are actually RTFs crafted to exploit a vulnerability in Microsoft Word: CVE-2012-0158. This particular vulnerability was first exploited in early April 2012 and a patch was released by Microsoft on April 10, 2012. | Attached to the email were what appeared to be three Microsoft Word documents (.doc), but which were trojaned with a malware family we call “Surtr”.

via citizenlabcitizenlab.ca

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

The email in question purported to be from a prominent member of the Tibetan community and repurposed content from a community mailing list. Attached to the email were what appeared to be three Microsoft Word documents (.doc), but which were trojaned with a malware family we call “Surtr”.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

Surtr’s capabilities include listing of file directories and contents on the victim computer and any USB drives connected to a victim machine, viewing web cache, executing remote commands and logging keystrokes.

T1203Exploitation for Client ExecutionEvidence1

While the malicious attachments appear to be DOC files due to their file extension, they are actually RTFs crafted to exploit a vulnerability in Microsoft Word: CVE-2012-0158.

Persistence

2 techniques

T1112Modify RegistryEvidence1

It also stores its C2 information and a campaign code in the registry. Depending on the configuration, Surtr will either create multiple registry keys in SoftwareMicrosoftWindows Media in HKU (hkey users) with text data or a single key called XC consisting of binary data.

T1547.001Registry Run Keys / Startup FolderEvidence1

For persistency, Surtr adds a key to the registry to ensure it runs when the infected computer is restarted.

Privilege Escalation

2 techniques

T1055Process InjectionEvidence1

Surtr creates either a new explorer or iexplore process and injects itself into this new process using CreateRemoteThread function.

T1547.001Registry Run Keys / Startup FolderEvidence1

For persistency, Surtr adds a key to the registry to ensure it runs when the infected computer is restarted.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

The keylogger output is disguised by adding a constant to the ordinal value of the character... Depending on the configuration... These are usually xor encrypted with a key of 0x1.

T1055Process InjectionEvidence1

Surtr creates either a new explorer or iexplore process and injects itself into this new process using CreateRemoteThread function.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Credential Access

1 technique

T1056.001KeyloggingEvidence1

Discovery

1 technique

T1083File and Directory DiscoveryEvidence1

Surtr’s capabilities include listing of file directories and contents on the victim computer and any USB drives connected to a victim machine

Collection

2 techniques

T1056.001KeyloggingEvidence1

T1560Archive Collected DataEvidence1

This data can then be sent to the C2. It is compressed using zlib DEFLATE so the network traffic is not human readable without decompression.

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

Surtr connects to a command and control server (C2) and downloads a stage two component to %ALL USERS%/Application Data/Microsoft/Windows/Burn/_[VICTIM COMPUTER NAME].log.

T1105Ingress Tool TransferEvidence1

Surtr connects to a command and control server (C2) and downloads a stage two component to %ALL USERS%/Application Data/Microsoft/Windows/Burn/_[VICTIM COMPUTER NAME].log.

INDICATORS OF COMPROMISE

IOCs tracked for this family

56 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

34 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

20 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

citizenlabNews

Jul 24, 2026

Surtr: Malware Family Targeting the Tibetan Community

Surtr is a targeted malware family used in attacks against Tibetan groups. It exploits CVE-2012-0158-delivered malicious documents, injects into explorer or iexplore via CreateRemoteThread, establishes persistence via registry keys, contacts C2 to download a second-stage component, enumerates files and USB contents, views web cache, executes remote commands, logs keystrokes, compresses exfiltrated data with zlib DEFLATE, and can download additional malware.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching56

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 1 CVE

Surtr

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2012-0158MSCOMCTL.OCX ActiveX Controls Remote Code ExecutionExploited in the wild

via citizenlabcitizenlab.ca

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

T1203Exploitation for Client ExecutionEvidence1

While the malicious attachments appear to be DOC files due to their file extension, they are actually RTFs crafted to exploit a vulnerability in Microsoft Word: CVE-2012-0158.

Persistence

2 techniques

T1112Modify RegistryEvidence1

T1547.001Registry Run Keys / Startup FolderEvidence1

For persistency, Surtr adds a key to the registry to ensure it runs when the infected computer is restarted.

Privilege Escalation

2 techniques

T1055Process InjectionEvidence1

Surtr creates either a new explorer or iexplore process and injects itself into this new process using CreateRemoteThread function.

T1547.001Registry Run Keys / Startup FolderEvidence1

For persistency, Surtr adds a key to the registry to ensure it runs when the infected computer is restarted.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

The keylogger output is disguised by adding a constant to the ordinal value of the character... Depending on the configuration... These are usually xor encrypted with a key of 0x1.

T1055Process InjectionEvidence1

Surtr creates either a new explorer or iexplore process and injects itself into this new process using CreateRemoteThread function.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Credential Access

1 technique

T1056.001KeyloggingEvidence1

Discovery

1 technique

T1083File and Directory DiscoveryEvidence1

Surtr’s capabilities include listing of file directories and contents on the victim computer and any USB drives connected to a victim machine

Collection

2 techniques

T1056.001KeyloggingEvidence1

T1560Archive Collected DataEvidence1

This data can then be sent to the C2. It is compressed using zlib DEFLATE so the network traffic is not human readable without decompression.

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

Surtr connects to a command and control server (C2) and downloads a stage two component to %ALL USERS%/Application Data/Microsoft/Windows/Burn/_[VICTIM COMPUTER NAME].log.

T1105Ingress Tool TransferEvidence1

Surtr connects to a command and control server (C2) and downloads a stage two component to %ALL USERS%/Application Data/Microsoft/Windows/Burn/_[VICTIM COMPUTER NAME].log.

INDICATORS OF COMPROMISE

IOCs tracked for this family

56 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

34 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

20 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

citizenlabNews

Jul 24, 2026

Surtr: Malware Family Targeting the Tibetan Community

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching56

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.