Loading story…
Microsoft documented CVE-2021-40444 as a remote code execution flaw in the MSHTML engine that could be triggered through specially crafted Microsoft Office documents, and security reporting tied the issue to attachment-based phishing campaigns. MITRE ATT&CK maps this activity to T1566.001 Spearphishing Attachment, a technique widely used by both state-backed and criminal actors to gain initial access through Word, Excel, RTF, PDF, archive, and shortcut files sent by email.
Security telemetry and malware analysis showed how the technique translated into real-world intrusion activity. A suspicious Word document sample analyzed in ANY.RUN and Trustwave reporting on a trojanized OneNote lure illustrate the broader pattern of weaponized Office attachments being used to execute payloads such as FormBook. Splunk also published detection guidance for spotting Office processes loading mshtml.dll, noting that such module loads can indicate exploitation of CVE-2021-40444 and may precede arbitrary code execution, data theft, or deeper compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
Splunk removed the deprecated detection "Office Product Writing cab or inf" from its Threat Research content library in version 5.2.0, stating it had been renamed and its logic updated. Splunk identified the replacement analytic as "Windows Office Product Dropped Cab or Inf File."
Splunk deprecated and removed the detection "MSHTML Module Load in Office Product" in version 5.2.0, stating it had been renamed and its logic updated. Splunk identified the replacement as "Windows Office Product Loaded MSHTML Module."
Between October 24 and 25, 2021, attackers ran a short-lived spam campaign that adapted CVE-2021-40444 exploitation by replacing the earlier CAB-based delivery chain with a malformed RAR archive containing a weaponized Word document. On unpatched systems the chain launched PowerShell and downloaded FormBook from 104.244.78.177, while patched systems could still attempt the outbound connection but did not complete exploitation.
Microsoft published a technical analysis of attacks exploiting CVE-2021-40444, documenting how the MSHTML vulnerability was being used in the wild. The report added Microsoft's own investigation and attack details beyond the earlier advisory.
Trend Micro analyzed multiple malicious Office documents exploiting CVE-2021-40444 and described an attack chain in which an external HTML file used obfuscated JavaScript to download a CAB archive, extract a DLL, and execute championship.inf via path traversal. The report said the exploitation delivered a Cobalt Strike beacon and published related hashes and infrastructure.
Microsoft disclosed interim defenses for the actively exploited CVE-2021-40444 MSHTML zero-day, recommending disabling ActiveX controls in Internet Explorer via registry changes until a patch became available. The company said the flaw was being used in targeted attacks through malicious Office documents and noted Defender detections for related exploitation activity.
ANY.RUN published an interactive analysis task for the file "A Letter before court 4.docx" with MD5 1D2094CE85D66878EE079185E2761BEB. The sample is relevant to the reference set around Office document-based exploitation activity.
Trend Micro reported a campaign in which attackers used malicious Word attachments exploiting CVE-2021-40444 to deliver FormBook 4.1. The operators modified public exploit code to evade detections and used a two-stage PowerShell chain, with the second-stage payload hosted on Discord.
During the 2015 Ukraine Electric Power Attack, Sandworm Team gained initial footholds in many IT systems using Microsoft Office attachments delivered through phishing emails.
Kaspersky said exploitation attempts for CVE-2021-40444 were still occurring worldwide, targeting organizations in sectors including R&D, energy, industrial, banking, medical technology, telecommunications, and IT. The company said newer campaigns were delivering various malware families, mostly backdoors, and published related indicators and detections.
Microsoft Security Response Center published guidance for CVE-2021-40444, the MSHTML remote code execution vulnerability referenced by later detection content.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
17 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourceresearch.splunk.com
Open sourceresearch.splunk.com
Open sourcenews.sophos.com
Open sourceattack.mitre.org
Open sourcesupport.microsoft.com
Open sourcetrustwave.com
Open sourcedomaintools.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers used **CVE-2017-0199** in malicious Microsoft Word and RTF documents to trigger the `hta` handler and pull follow-on payloads from attacker-controlled infrastructure, enabling code execution without relying on macros. One observed chain used a fake invoice attachment disguised as a `.doc` file to fetch a malicious HTA, then downloaded a Remcos RAT installer and an AutoIt-based persistence component over HTTPS from `streetsave[.]club` and `regwide[.]club`; the infected host later communicated with `darlz.freeddns[.]org` on port `1695`. Separate in-the-wild activity documented the same exploit delivering Visual Basic script stages that killed `winword.exe`, retrieved a payload disguised as an image, copied it as a Startup-folder `winword.exe`, and opened a decoy document to hide the intrusion. Researchers linked final payloads to **WingBird** and **FinFisher-like** malware, while other malicious documents delivered **LATENTBOT**; the campaigns relied on obfuscation, anti-analysis techniques, and persistence through registry Run keys or Startup-folder placement, underscoring the need to patch vulnerable Office systems.
Aug 15, 2026
Microsoft’s February 2026 security update addressed **59 vulnerabilities** across Windows, Azure, Microsoft Office, and Visual Studio Code, including **5 Critical** issues. NSFOCUS reported that **six vulnerabilities were already being exploited in the wild**, including **MSHTML Framework Security Feature Bypass (CVE-2026-21513)**, **Windows Shell Security Feature Bypass (CVE-2026-21510)**, **Microsoft Word Security Feature Bypass (CVE-2026-21514)**, **Desktop Window Manager EoP (CVE-2026-21519)**, **Windows Remote Access Connection Manager DoS (CVE-2026-21525)**, and **Windows Remote Desktop Service EoP (CVE-2026-21533)**. Akamai attributed active exploitation of **CVE-2026-21513** to **APT28**, reporting the flaw affects all supported Windows versions and enables a **security feature bypass leading to arbitrary file execution** (CVSS **8.8**). Akamai’s root-cause analysis placed the issue in `ieframe.dll`, in the `_AttemptShellExecuteForHlinkNavigate` hyperlink-navigation path, where insufficient URL validation can allow attacker-controlled input to reach code paths invoking `ShellExecuteExW`, enabling execution outside the intended browser security context. Akamai also linked a malicious sample (reported as `document.doc.LnK.download`) to APT28-associated infrastructure and described use of a crafted **`.lnk`** that embeds an HTML file and contacts **`wellnesscaremed[.]com`** as part of the exploitation chain prior to Microsoft’s February patch release.
Jun 29, 2026
Sofacy (**APT28**) targeted a U.S. government agency with a spear-phishing campaign that delivered a weaponized RTF document themed around the NATO exercise *Noble Partner 2016*. The attachment exploited **`CVE-2015-1641`** to install a loader DLL and a Carberp-based Sofacy payload, then established persistence through an unusual Microsoft Office registry path under `Software\Microsoft\Office test\Special\Perf`, causing the malware to load whenever a user opened an Office application. The malware profiled infected hosts and used encrypted, Base64-encoded HTTP POST traffic to communicate with infrastructure including `191.101.31.6`, while also beaconing to `google.com`. The intrusion reflects a broader pattern highlighted by U.S. government agencies, which warned that foreign state-linked actors routinely exploit well-known vulnerabilities in Microsoft Office and other widely deployed products to gain initial access and sustain intrusions. CISA and the FBI have identified Office-related flaws among the most frequently abused weaknesses, alongside other long-lived vulnerabilities that remain effective because organizations delay patching or continue using outdated software. The case underscores the operational value of rapid patching, retiring end-of-life systems, and hardening Office and related enterprise software against phishing-led exploitation.
Aug 15, 2026