Loading story…
Targeted threat actors used malicious Microsoft Office documents exploiting CVE-2012-0158 to compromise victims in long-running espionage campaigns, including Tibetan organizations and primarily Russian-speaking individuals. Citizen Lab reported that trojanized Word attachments in 2012 and 2013 delivered the Surtr malware family, while Symantec documented the Scarab group using spearphishing emails, compressed archives, and later .scr droppers to install Trojan.Scieron and Trojan.Scieron.B on a small number of carefully selected systems each month.
The malware families provided persistent backdoor and surveillance capabilities after infection. Surtr injected into explorer or iexplore, stored campaign and command-and-control data in the registry, and supported file listing, USB enumeration, web cache viewing, remote command execution, and keylogging, with observed C2 including internet.3-a.net on port 9696 and a second-stage payload named x86_GmRemote.dll. Scieron acted as a downloader and backdoor, while Scieron.B added stronger remote access features and a rootkit-like component to hide some network activity; Symantec said Scarab’s infrastructure relied on dynamic DNS and C2 servers commonly hosted in South Korea. The campaigns showed that the widely exposed Microsoft Windows Common Controls ActiveX flaw affected numerous Microsoft products and remained a practical delivery vector for tailored espionage operations.
TTPs, infrastructure, and targeting history in one profile.
15 events from the most recent confirmed update back to the earliest known activity.
The SecurityFocus/Bugtraq record for CVE-2012-0158 lists a last update date of September 25, 2017. This reflects a later update to the vulnerability entry rather than a new exploitation event.
From January 2014 onward, Scarab used .scr files, often with Russian-language titles, to drop Trojan.Scieron. This represented a delivery change from the earlier malicious document droppers.
Symantec reported that Scarab continued to send malicious .doc droppers intermittently until August 2013. These documents included exploits for older patched vulnerabilities such as CVE-2012-0158.
Citizen Lab analyzed a malicious email sent to Tibetan organizations in June 2013 that impersonated a prominent community member and carried three trojanized Word attachments. The attachments were actually RTF files exploiting CVE-2012-0158 to deliver the Surtr malware family.
From April 2013 until at least January 2014, Scarab used finance- and G20-related lures against targets including a European government, an international economic organization, and a European government's economic ministry. This marked an evolution from earlier academic and generic themes.
Citizen Lab noted that the malicious template used in Surtr attacks was created in March 2013. The template used the Chartspace Office Web Component to trigger code execution via CVE-2012-0158.
Seven days after the January 22 email, Scarab sent another phishing email to the same two individuals with the Russian-language subject “Информация по обслуживанию высвобожденны.” This showed continued follow-up targeting of the same victims.
On January 22, 2013, Scarab sent an email with the subject “Joint Call For Papers - Conferences / Journal Special Issues, January 2013” to two individuals associated with an Australian-funded academic research project. The lure reflected the group's earlier academic-themed targeting.
Citizen Lab reported that it had observed Surtr used in attacks on Tibetan groups dating back to November 2012. This established the malware family's use before the later June 2013 campaign it analyzed in detail.
On October 29, 2012, Scarab sent a Russian-language phishing email with the subject “Экспериментальное определение эффективно” to two individuals working for a large retail organization. The message was part of the group's targeted spearphishing activity.
Symantec observed that a number of Scarab phishing emails began being blocked by Symantec .Cloud starting in October 2012. The blocked messages were sent from @yandex.ru email addresses.
Citizen Lab found that the domain internet.3-a.net resolved to 184.82.123.143 in May 2012, the same IP as android.uyghur.dnsd.me. Citizen Lab had previously documented android.uyghur.dnsd.me as Android malware command-and-control infrastructure targeting the Tibetan community.
Citizen Lab stated that Microsoft released a patch for CVE-2012-0158. This patch predated later phishing campaigns that continued to exploit the vulnerability.
The Microsoft Windows Common Controls ActiveX Control remote code execution vulnerability, tracked as CVE-2012-0158, was published in SecurityFocus as Bugtraq ID 52911. The entry described it as a remotely exploitable design error affecting a wide range of Microsoft products.
Symantec assessed that the Scarab espionage campaign had targeted primarily Russian-speaking individuals inside and outside Russia since at least January 2012. The group used highly targeted phishing and custom malware rather than broad enterprise compromises.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 56 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
citizenlab.ca
Open sourcecommunity.broadcom.com
Open sourcesecurityfocus.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026
Multiple early-2026 campaigns highlight increasingly **low-noise initial access** and **living-off-the-land** execution on Windows endpoints. CyStack reported activity attributed to **APT-Q-27 (GoldenEyeDog)** targeting financial institutions via a corporate support workflow: a user clicked a malicious link delivered through a **Zendesk ticket**, leading to download of an executable masquerading as an image/`.pif` file (aided by Windows’ hidden-extension defaults). The malware was signed with a **revoked certificate** that still appeared trusted due to a valid timestamp, and its modular backdoor/C2 infrastructure overlapped with prior APT-Q-27 activity, enabling stealthy persistence and control without triggering common endpoint alerts. Separately, Securonix described the **Dead#Vax** multistage campaign using phishing links to **VHD files hosted on IPFS**, where mounting/opening the VHD triggers **Windows Script Files**, obfuscated batch, and **PowerShell** loaders to support encrypted data theft and conceal execution logic, culminating in **AsyncRAT** deployment for credential theft, surveillance, and follow-on intrusion. In another targeted operation, Zscaler ThreatLabz linked **Operation Neusploit** to **APT28**, exploiting **CVE-2026-21509** (Microsoft Office/365 **OLE** bypass) via crafted **RTF** documents to drop payloads including **MiniDoor** (Outlook-focused collection and mailbox manipulation, including exfiltration to attacker-controlled email accounts) and **PixyNetLoader** (reported to use steganography). A separate “ThreatsDay” bulletin is a multi-story roundup and does not provide additional, specific corroboration on these same campaigns beyond mentioning adjacent themes (e.g., AsyncRAT/C2) in a broader news digest.
Jun 29, 2026
The **Bitter** espionage group, also tracked as **TA397** and **APT-Q-37**, has conducted sustained targeting across South Asia and neighboring regions, hitting government, military, energy, engineering, and other sensitive organizations in countries including **Bangladesh, Pakistan, Saudi Arabia, and China**. Researchers linked the activity through overlapping command-and-control infrastructure, recurring phishing lures, and repeated use of malicious Office documents, MSI installers, SFX archives, and compromised legitimate websites. In one campaign against Bangladeshi law-enforcement officials, spear-phishing emails delivered weaponized RTF and Excel files that exploited known Microsoft Office flaws to install the **ZxxZ** trojan, while earlier operations against Pakistan and Saudi Arabia used **ArtraDownloader**, including samples exploiting `CVE-2017-11882` via Microsoft Equation Editor.
Aug 15, 2026