{
  "family": "wews",
  "sample_count": 111,
  "category": "exploit",
  "description": "Wews (recognized across threat telemetry signatures as Exploit:HTML/Wews, Exploit.HTML.Wews, and Trojan-Downloader.HTML.Wews) is a specialized class of malicious web-based exploit scripts active since 2013. Designed to weaponize browser rendering engines, Wews payloads are delivered via drive-by download compromise portals, malvertising networks, and prominent exploit kit frameworks (including Angler, Sweet Orange, and Fiesta). When a victim navigates to a compromised webpage hosting Wews, heavily obfuscated JavaScript executes in the background to fingerprint the client browser, operating system architecture, and installed plugin versions (such as Adobe Flash, Oracle Java, or Internet Explorer modules). Upon detecting a vulnerable rendering component, the script triggers heap spraying and memory corruption exploits to escape browser sandboxes and execute arbitrary shellcode. Once initial code execution is established, Wews silently fetches and runs secondary binaries—such as banking trojans, information stealers, or ransomware droppers—directly in system memory without requiring user interaction.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Exploit:HTML/Wews",
    "Exploit.HTML.Wews",
    "Trojan-Downloader.HTML.Wews",
    "HTML/Wews"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What does the Exploit:HTML/Wews detection signify?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It identifies malicious HTML or JavaScript designed to exploit browser vulnerabilities during drive-by download attacks."
      }
    },
    {
      "@type": "Question",
      "name": "How does Wews achieve code execution?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It fingerprints the browser environment and deploys memory corruption or heap spray exploits against vulnerable browser components."
      }
    },
    {
      "@type": "Question",
      "name": "Which delivery channels commonly host Wews exploits?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Wews is hosted on compromised websites, malicious advertising (malvertising) networks, and multi-stage exploit kit landing pages."
      }
    },
    {
      "@type": "Question",
      "name": "Does Wews require user interaction to infect a machine?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No, simply rendering the malicious web page in a vulnerable, unpatched browser is sufficient to trigger the exploit chain."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be defended against HTML-based exploits?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Keep browsers and operating systems fully patched, disable outdated legacy plugins, and employ web reputation filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1189",
    "T1203",
    "T1059.007",
    "T1027",
    "T1105",
    "T1204.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1203",
      "name": "Exploitation for Client Execution",
      "tactic": "Execution"
    },
    {
      "id": "T1059.007",
      "name": "Command and Scripting Interpreter: JavaScript",
      "tactic": "Execution"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Review endpoint EDR telemetry to verify whether the browser process spawned suspicious child processes (e.g., cmd.exe, powershell.exe).",
    "If an anomalous child process or secondary dropped executable is detected, isolate the machine immediately.",
    "Block the malicious domain and exploit landing URLs at the enterprise proxy and web application gateway.",
    "Ensure browser updates and security patches are enforced across all workstations to remediate underlying rendering vulnerabilities."
  ],
  "what_to_avoid": [
    "Do not assume the machine is clean merely because antivirus blocked the HTML file, as the shellcode may have already executed in memory.",
    "Avoid permitting unvetted browser plugins or legacy script rendering engines to run in enterprise environments."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Enterprise Endpoints",
    "Healthcare and Public Sector"
  ],
  "motivation": "Initial Access",
  "threat_actors": [
    "Unknown / Cybercriminal",
    "Exploit Kit Syndicates"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "defense_evasion"
  ],
  "ecosystem": [
    "windows_pe",
    "web_browser"
  ],
  "is_emerging": false,
  "first_seen": 2013,
  "lineage": {
    "derived_from": [
      "Drive-By Download Exploit Kits"
    ],
    "variants": [
      "Exploit:HTML/Wews.A",
      "Exploit:HTML/Wews.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c",
      "2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d"
    ],
    "delivery": [
      "Compromised website iframes and malvertising networks",
      "Exploit kit landing page redirects"
    ],
    "persistence": [
      "Secondary dropped payload execution via Windows Scheduled Tasks",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Exploit:HTML/Wews",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Exploit:HTML/Wews"
    },
    {
      "name": "Trend Micro Security Intelligence - Exploit-HTML",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/exploit.html"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}