Loading story…
Attackers used CVE-2017-0199 in malicious Microsoft Word and RTF documents to trigger the hta handler and pull follow-on payloads from attacker-controlled infrastructure, enabling code execution without relying on macros. One observed chain used a fake invoice attachment disguised as a .doc file to fetch a malicious HTA, then downloaded a Remcos RAT installer and an AutoIt-based persistence component over HTTPS from streetsave[.]club and regwide[.]club; the infected host later communicated with darlz.freeddns[.]org on port 1695.
Separate in-the-wild activity documented the same exploit delivering Visual Basic script stages that killed winword.exe, retrieved a payload disguised as an image, copied it as a Startup-folder winword.exe, and opened a decoy document to hide the intrusion. Researchers linked final payloads to WingBird and FinFisher-like malware, while other malicious documents delivered LATENTBOT; the campaigns relied on obfuscation, anti-analysis techniques, and persistence through registry Run keys or Startup-folder placement, underscoring the need to patch vulnerable Office systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
After execution, the infected host downloaded additional payloads from streetsave[.]club and regwide[.]club, installed a Remcos RAT component, and used an AutoIt-based persistence mechanism. The compromised system then communicated with darlz.freeddns[.]org over port 1695 and created persistence-related registry keys including a Run key named "WindowsUpdate."
A malspam campaign dated 2017-12-21 sent an email with subject "Invoice" and an attachment named "Proforma invoice.doc" that was actually an RTF exploiting CVE-2017-0199. The exploit chain retrieved a malicious HTA file and led to delivery of Remcos RAT.
The analyzed CVE-2017-0199 infection chain terminated winword.exe to hide prompts, downloaded a payload disguised as copy.jpg, saved it as a Startup-folder winword.exe for persistence, and opened a decoy document to mask the compromise. The final payload was assessed as a WingBird dropper variant with similarities to FinFisher and anti-analysis protections including a custom virtual machine.
FireEye observed in-the-wild exploitation of CVE-2017-0199 in Microsoft Word using malicious documents that linked to attacker-controlled servers. Two documents were noted as successfully executing payloads, one delivering LATENTBOT and another delivering WingBird/FinFisher.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cloud.google.com
Open sourcemalware-traffic-analysis.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers traced a **SideWinder** spearphishing campaign to a malicious Word document named **"Briefing on Ongoing Projects.docx"** that fetched a remote RTF template from a spoofed domain and exploited Microsoft Equation Editor via `CVE-2017-11882`. The recovered RTF decrypted embedded JavaScript, launched an obfuscated script, and executed a .NET component that profiled installed antivirus products before attempting to download a further payload stage. Investigators found the originally malicious RTF had later been replaced with a nearly empty placeholder file, a tactic that obscured follow-on analysis while preserving infrastructure clues. Additional infrastructure and tradecraft links tied the activity to broader South Asian espionage patterns involving malicious RTF lures, Equation Editor exploitation, and multi-stage loaders. Fortinet separately documented a spearphishing attack against a telecommunications agency in South Asia using an RTF lure that exploited `CVE-2018-0798`, abused **Logitech** DLL search order hijacking with a signed executable and malicious `LBTServ.dll`, injected into `svchost.exe`, and contacted `instructor[.]giize[.]com` to retrieve a payload linked through OSINT to **PoisonIvy RAT**. Across the references, the campaigns show consistent use of document-based initial access, obfuscated intermediate stages, and reusable infrastructure and tooling associated with long-running regional espionage operations.
Aug 15, 2026
A large email campaign used malicious Microsoft Word RTF attachments to exploit **CVE-2017-0199** and install the **Dridex** banking trojan on vulnerable systems. Researchers said the operation targeted millions of recipients across numerous organizations, primarily in Australia, using lures such as "Scan Data" and spoofed sender formats to make booby-trapped documents appear legitimate. Proofpoint identified the activity as a notable shift for Dridex operators, who had more commonly relied on macro-enabled documents, while McAfee, FireEye, and Ars Technica reported that the exploit worked broadly across Windows versions of Word and could bypass common exploit mitigations. The attack was especially dangerous because it did not require macros and could execute even when Word presented warning dialogs; in many Protected View cases, users only needed to click **Enable Editing** for the infection chain to proceed. Successful exploitation reportedly installed **Dridex botnet ID 7500**, and Microsoft issued a patch for the flaw on April 11 after researchers warned that the zero-day had already been rapidly weaponized in the wild. Separately, Microsoft has also disclosed **CVE-2026-35440**, an **Important** Microsoft Word information disclosure flaw that requires user interaction and is assessed as less likely to be exploited, but it was not reported as publicly exploited.
Jun 29, 2026
Microsoft documented **CVE-2021-40444** as a remote code execution flaw in the MSHTML engine that could be triggered through specially crafted Microsoft Office documents, and security reporting tied the issue to attachment-based phishing campaigns. MITRE ATT&CK maps this activity to **`T1566.001` Spearphishing Attachment**, a technique widely used by both state-backed and criminal actors to gain initial access through Word, Excel, RTF, PDF, archive, and shortcut files sent by email. Security telemetry and malware analysis showed how the technique translated into real-world intrusion activity. A suspicious Word document sample analyzed in ANY.RUN and Trustwave reporting on a trojanized OneNote lure illustrate the broader pattern of weaponized Office attachments being used to execute payloads such as **FormBook**. Splunk also published detection guidance for spotting Office processes loading **`mshtml.dll`**, noting that such module loads can indicate exploitation of **CVE-2021-40444** and may precede arbitrary code execution, data theft, or deeper compromise.
Aug 15, 2026