Technical intelligence and weaponization dossier for CVE-2010-0805. Documented exploitation across 5 active malware families totaling 29,415 analyzed telemetry samples.
| Vulnerability ID | CVE-2010-0805 |
|---|---|
| Common Name / Bulletin | Microsoft Internet Explorer Peer Factory Use-After-Free Vulnerability (MS10-018) |
| CWE Classification | CWE-416: Use After Free in mshtml.dll |
| Affected Software & Versions | Microsoft Internet Explorer 6 and 7 |
| Technical Root Cause | Use-after-free vulnerability in mshtml.dll when handling DOM document elements and peer factory behaviors, exploited in drive-by downloads by banking trojans. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 5 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| zbot | Banking Trojan | 24,075 | Zbot (universally known as Zeus, and documented under variants such as Zeus Panda, GameOver Zeus, and Wsnpoem) is arguably the most influential banking trojan a... |
| lethic | Spam Bot | 4,879 | Lethic is a notorious, long-running spam-distribution botnet that first emerged in 2008. Designed specifically as an automated email transmission engine for Eas... |
| expiro | File Infector | 305 | Expiro (classified across security vendors as Virus:Win32/Expiro, Virus:Win64/Expiro, and Xpiro) is one of the most sophisticated, long-lived polymorphic cross-... |
| bifrost | Rat | 95 | Bifrost (also documented across threat research as Bifrose, Backdoor:Win32/Bifrose, and Trojan.Bifrose) is a resilient, long-standing remote access trojan (RAT)... |
| carberp | Banking Trojan | 61 | Carberp is an elite, highly sophisticated banking trojan and modular cyber espionage framework first identified in 2010. Developed by a well-organized Russian-U... |
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2010-0805 in enterprise networks:
High-volume crash events from iexplore.exe referencing mshtml!CPeerHolder objects; suspicious heap spray patterns in browser process memory.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Backdoor & RAT Protection for Businesses →