Technical intelligence and weaponization dossier for CVE-2012-0158. Documented exploitation across 75 active malware families totaling 82,262 analyzed telemetry samples.
| Vulnerability ID | CVE-2012-0158 |
|---|---|
| Common Name / Bulletin | Microsoft Office MSCOMCTL.OCX ActiveX TreeView / ListView Buffer Overflow (MS12-027) |
| CWE Classification | CWE-119: Memory Corruption in ActiveX Controls |
| Affected Software & Versions | Microsoft Office 2003, 2007, 2010, SQL Server, Commerce Server |
| Technical Root Cause | Stack-based buffer overflow in MSCOMCTL.OCX ActiveX control when deserializing TreeView or ListView controls embedded in RTF or Word documents. One of the most frequently weaponized vulnerabilities in cybercrime history. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 75 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| xtrat | Rat | 35,969 | Xtreme RAT (widely tracked as xtrat or xrat) is a feature-complete, commercial-grade remote access trojan that first surfaced in late 2010. Engineered originall... |
| fareit | Infostealer | 10,955 | Fareit (widely recognized across the threat intelligence community as Pony or Pony Stealer) is one of the most influential and pervasive credential-harvesting i... |
| upatre | Downloader | 4,200 | Upatre is a notoriously lightweight, high-volume downloader first identified in mid-2013 that served as the initial spearhead for some of the most catastrophic ... |
| gamarue | Loader | 2,789 | Gamarue (widely tracked by security vendors as Andromeda or Wauchos) is one of the most prolific and technically sophisticated modular botnet loaders in the his... |
| tinba | Banking Trojan | 1,531 | Trojan:Win32/Tinba (short for 'Tiny Banker', also cataloged by vendors as Zusy) is a landmark banking trojan famous for its remarkably micro-sized footprint—com... |
| erazer | Trojan | 1,500 | Erazer (identified across antivirus engines as Trojan:Win32/Erazer and Backdoor.Erazer) is a classic dual-function Remote Access Trojan (RAT) and disruptive dis... |
| fearless_key_spy | Spyware | 1,500 | Fearless Key Spy (cataloged across security software as Trojan-Spy.Win32.FearlessKeySpy and Spyware.Win32.Fearless) is a specialized Windows keystroke logger an... |
| fearless_lite | Spyware | 1,500 | Fearless Lite (tracked across antivirus engines as Trojan-Spy.Win32.FearlessLite and Spyware.FearlessLite) is a streamlined, low-footprint variant of the Fearle... |
| flux | Backdoor | 1,500 | Flux (cataloged across antivirus solutions as Backdoor:Win32/Flux and Trojan.Win32.Flux) is a classic Delphi-authored remote access backdoor trojan first surfac... |
| hack_a_tack | Trojan | 1,500 | Hack a Tack (cataloged across antivirus vendors as Trojan:Win32/HackaTack, Backdoor.HackaTack, and Trojan.Hack-a-Tack) is a classic remote access trojan and bac... |
| hav_rat | Rat | 1,500 | Hav-RAT (cataloged across antivirus software as Backdoor:Win32/HavRAT, Trojan.Win32.HavRAT, and Backdoor.HavRat) is a classic Delphi-authored Remote Access Troj... |
| hue | Trojan | 1,500 | Hue (cataloged across security engines as Trojan:Win32/Hue, Backdoor:Win32/Hue, and Trojan.Win32.Hue) is a legacy Delphi-authored remote access backdoor trojan ... |
| icecold_reloaded | Rat | 1,500 | IceCold Reloaded (cataloged across security software as Backdoor:Win32/IceCold.Reloaded, Trojan.Win32.IceCold, and Backdoor.IceCold) is a classical Delphi-based... |
| infector_ng_2004 | Trojan | 1,500 | Infector NG 2004 (Infector Next Generation, cataloged across security telemetry as Trojan:Win32/InfectorNG2004, Virus:Win32/InfectorNG, and Trojan.Win32.Infecto... |
| darkkomet | Rat | 801 | DarkComet (frequently cataloged in security telemetry as DarkKomet or Backdoor.Win32.DarkKomet) is an iconic, feature-packed Remote Access Trojan (RAT) original... |
| nymaim | Downloader | 756 | Nymaim is a sophisticated dual-stage malware downloader and loader first observed in 2013. Designed with extreme resilience, Nymaim specialized in evading secur... |
| yakes | Trojan | 751 | Trojan:Win32/Yakes (widely cataloged across antivirus telemetry as Trojan.Yakes or Win32/Yakes) is a prolific family of obfuscated trojan downloaders and multi-... |
| urelas | Infostealer | 666 | Trojan:Win32/Urelas is a specialized information stealer and credential extraction trojan engineered to harvest authentication credentials, session cookies, and... |
| qqpass | Infostealer | 612 | Trojan-PSW.Win32.QQPass (broadly cataloged in antivirus telemetry as PWS:Win32/QQPass) is an aggressive, specialized password stealer engineered explicitly to t... |
| vbkryjetor | Packer | 551 | Vbkryjetor (identified across commercial security telemetry as Packer:Win32/Vbkryjetor, Trojan:Win32/Vbkryjetor, and Crypter.Vbkryjetor) is a specialized Visual... |
| agentb | Trojan | 449 | Agent.B (classified across commercial antivirus vendors as Trojan:Win32/Agent.B, Trojan-Downloader.Win32.Agent.b, and Backdoor.Agent.B) is a long-standing, prol... |
| memery | Trojan | 445 | Memery (cataloged across security software as Trojan:Win32/Memery, Backdoor:Win32/Memery, and Trojan-Spy.Win32.Memery) is an evasive memory-resident trojan and ... |
| neshta | File Infector | 443 | Neshta (cataloged across cybersecurity authorities as Virus:Win32/Neshta.A, Virus.Win32.Neshta, and Win32/Neshta) is one of the most prolific, long-standing, an... |
| zegost | Rat | 441 | Trojan:Win32/Zegost (widely documented by threat researchers as Backdoor.Zegost or Zegost RAT) is a sophisticated cyber espionage Remote Access Trojan and rootk... |
| ausiv | Trojan | 422 | Ausiv (cataloged across security vendors as Trojan:Win32/Ausiv, Worm:Win32/Ausiv, and Trojan.Win32.Ausiv) is a hybrid Windows trojan and worm framework that eme... |
| ekstak | Trojan | 421 | Ekstak (cataloged across security software as Trojan.Win32.Ekstak, Trojan:Win32/Ekstak, and Worm:Win32/Ekstak) is a covert Windows backdoor trojan and spyware f... |
| cosmicduke | Infostealer | 408 | Backdoor:Win32/CosmicDuke (also tracked as Bot-Moog, TinyBaron, or Nemor) is an advanced cyber espionage platform developed and deployed by APT29 (Cozy Bear / R... |
| lolbot | Worm | 374 | Worm:Win32/Lolbot is a notorious worm and remote access trojan that achieved massive global distribution by hijacking instant messaging platforms—including Skyp... |
| ponystealer | Infostealer | 374 | Trojan:Win32/PonyStealer (universally recognized in cyber threat intelligence as Pony or Fareit) is a foundational credential theft trojan and stage-one botnet ... |
| farfli | Rat | 360 | Trojan:Win32/Farfli is a sophisticated Remote Access Trojan (RAT) derived from the leaked Gh0st RAT codebase, customized extensively by Chinese state-sponsored ... |
| genkryptik | Packer | 353 | GenKryptik (classified across cybersecurity vendors as Trojan:Win32/GenKryptik, Packer:Win32/Kryptik, and Trojan.GenKryptik) is an evasive multi-stage software ... |
| ganelp | Trojan | 348 | Ganelp (cataloged across security solutions as Trojan:Win32/Ganelp, Trojan-Spy.Win32.Ganelp, and PWS:Win32/Ganelp) is a specialized password-stealing trojan and... |
| midie | Trojan | 341 | Midie (cataloged across security software as Trojan:Win32/Midie, Trojan.Win32.Midie, and Backdoor:Win32/Midie) is a modular Windows trojan and backdoor loader t... |
| snojan | Trojan | 324 | Snojan (cataloged across security research authorities as Trojan.Win32.SNOJAN.A, Trojan:Win32/Snojan, and Backdoor:Win32/Snojan) is a persistent backdoor trojan... |
| expiro | File Infector | 305 | Expiro (classified across security vendors as Virus:Win32/Expiro, Virus:Win64/Expiro, and Xpiro) is one of the most sophisticated, long-lived polymorphic cross-... |
| shiz | Banking Trojan | 302 | Trojan-Banker:Win32/Shiz is a notorious, historically significant Russian banking trojan that served as a critical evolutionary link connecting early Zeus and G... |
| dfay | Trojan | 300 | TrojanDropper:Win32/Dfay (widely cataloged across vendor telemetry as Trojan.Dfay or Win32/Dfay) is an evasive trojan dropper and memory injection loader engine... |
| regsup | Trojan | 296 | Regsup (cataloged across security vendors as Trojan:Win32/Regsup, PUA:Win32/Regsup, and Trojan.Win32.Regsup) is a Windows trojan downloader and potentially unwa... |
| kasidet | Pos Malware | 294 | Kasidet (cataloged across threat research as Neutrino Bot, Win32/Kasidet, Trojan.Kasidet, and Backdoor:Win32/Kasidet) is a sophisticated modular Windows botnet ... |
| banload | Downloader | 288 | Banload (cataloged across security software as TrojanDownloader:Win32/Banload, Trojan-Downloader.Win32.Banload, and Win32/Banload) is a notorious family of troj... |
| njrat | Rat | 280 | njRAT (also tracked as Bladabindi, Njw0rm, and Backdoor:MSIL/Bladabindi) is a notorious, widely disseminated remote access trojan (RAT) developed in Microsoft V... |
| poison | Rat | 261 | Poison Ivy (widely known across threat intelligence teams as PIVY) is one of the most historically significant and enduring Remote Access Trojans (RATs) in cybe... |
| olgames | Infostealer | 243 | PWS:Win32/Onlinegames (extensively tracked across security vendor databases as Trojan-PSW.Win32.OnLineGames or PSW.OnLineGames) is a massive, long-running famil... |
| quasar | Rat | 148 | Quasar (broadly tracked as Quasar RAT, QuasarRAT, Backdoor:MSIL/Quasar, and Trojan.MSIL.Quasar) is a high-performance open-source remote access trojan (RAT) dev... |
| salgorea | Backdoor | 135 | Salgorea (cataloged across advanced threat intelligence reports as Backdoor.Win32.Salgorea, BadCake, and Trojan:Win32/Salgorea) is a sophisticated targeted cybe... |
| rebhip | Rat | 120 | Worm:Win32/Rebhip is a stealthy dual-threat worm and keylogging trojan discovered in 2011 that proliferates via removable USB drives and unsecured local network... |
| ardamax | Infostealer | 114 | PWS:Win32/Ardamax (commercially branded as Ardamax Keylogger) is a surveillance tool originally created in 2004 as commercial employee and parental monitoring s... |
| gozi | Banking Trojan | 113 | Trojan:Win32/Gozi (also universally tracked as ISFB and the Ursnif family tree) is one of the most historically significant, resilient banking trojans in comput... |
| bifrost | Rat | 95 | Bifrost (also documented across threat research as Bifrose, Backdoor:Win32/Bifrose, and Trojan.Bifrose) is a resilient, long-standing remote access trojan (RAT)... |
| cutwail | Botnet | 92 | Cutwail (frequently referenced in conjunction with its rootkit and downloader component Pushdo, or Pandex) is one of the longest-running and highest-volume spam... |
| dorkbot | Botnet | 86 | Dorkbot (also tracked across intelligence communities as NgrBot and Worm:Win32/Dorkbot) is a notorious multi-vector worm and modular botnet family that infected... |
| netwire | Rat | 55 | NetWire (cataloged across threat research as NetWire RAT, NetWire.RC, Backdoor:Win32/Netwire, and Trojan.Netwire) is a cross-platform remote access trojan (RAT)... |
| vawtrak | Banking Trojan | 50 | Vawtrak (widely cataloged across international law enforcement and intelligence communities as Neverquest or Snifula) is one of the most damaging banking trojan... |
| kelihos | Spam Bot | 47 | Worm:Win32/Kelihos (also known as Hlux) was a massive, highly resilient peer-to-peer (P2P) botnet that operated from 2010 until its final federal dismantling in... |
| shylock | Banking Trojan | 21 | Shylock (also cataloged across international law enforcement and intelligence communities as Capito) is a sophisticated financial malware family and banking tro... |
| pony | Infostealer | 10 | Pony (cataloged across cybersecurity authorities as Fareit, Siplog, Trojan:Win32/Fareit, and PWS:Win32/Fareit) is one of the most prolific commodity information... |
| plugx | Rat | 8 | PlugX (also known across threat intelligence teams as Korplug or Sogu) is an exceptionally sophisticated, highly modular Remote Access Trojan first observed in ... |
| cybergate | Rat | 7 | Trojan:Win32/CyberGate is a classic, widely abused Delphi-based commercial Remote Access Trojan (RAT) that circulated extensively in the underground cybercrime ... |
| gh0st | Rat | 4 | Gh0st RAT (also tracked as Ghost RAT, Backdoor.Gh0st, and Win32/Gh0st) is one of the most historically significant, modular, and widely weaponized Remote Access... |
| carbanak | Banking Trojan | 2 | Carbanak (also cataloged across international law enforcement and intelligence communities as Anunak) is an elite, multi-million dollar cyber heist malware fram... |
| ghost | Rat | 1 | Gh0st RAT (also tracked in security taxonomies as GhostRAT or Backdoor.Gh0st) is a seminal open-source Remote Access Trojan originally authored in 2008 by the C... |
| zeusvm | Banking Trojan | 1 | Trojan-Banker:Win32/ZeusVM (also widely tracked in underground forums as KINS) is a highly sophisticated banking trojan variant derived from the leaked Zeus 2.0... |
| institution_2004 | Trojan | Sampled | Institution 2004 (cataloged across security software as Trojan:Win32/Institution2004, Backdoor.Win32.Institution, and Trojan.Institution) is an early 2000s Delp... |
| jbonblanc | Trojan | Sampled | JBonBlanc (cataloged across security software as Trojan:Win32/JBonBlanc, Backdoor.Win32.JBonBlanc, and Trojan.JBonBlanc) is a legacy French-authored Delphi remo... |
| jps | Trojan | Sampled | JPS (cataloged across security software as Trojan:Win32/JPS, Virus:Win32/JPS, and Trojan.Win32.JPS) is the compiled runtime client component generated by the JP... |
| jps_virus_maker | Tool | Sampled | JPS Virus Maker (cataloged across security software as HackTool:Win32/JPSVirusMaker, Tool:Win32/JPS, and Constructor.Win32.JPS) is a classical GUI-based virus c... |
| lanfiltrator | Trojan | Sampled | LanFiltrator (cataloged across security software as Trojan:Win32/LanFiltrator, Spyware.Win32.LanFiltrator, and Trojan.LanFiltrator) is a specialized local area ... |
| lost_door | Rat | Sampled | Lost Door (cataloged across security software as Backdoor.LostDoor, Trojan.Win32.LostDoor, and Backdoor:Win32/LostDoor) is a classic Delphi-authored Remote Acce... |
| messiah | Trojan | Sampled | Messiah (cataloged across security software as Trojan:Win32/Messiah, Backdoor.Win32.Messiah, and Trojan.Messiah) is a classic Delphi-authored remote access troj... |
| netsphere | Trojan | Sampled | NetSphere (cataloged across security software as Backdoor:Win32/NetSphere, Trojan.Win32.NetSphere, and Backdoor.NetSphere) is a classic early 2000s remote admin... |
| nuclear_rat | Rat | Sampled | Nuclear RAT (cataloged across security software as NuclearRAT, Nuclear RAT 2.1, Backdoor.NuclearRat, and Trojan.NuclearRAT) is a classic open-source Remote Acce... |
| prjraptor | Trojan | Sampled | PrjRAPTOR (frequently documented as Project Raptor, PrjRaptor, or Backdoor.PrjRaptor) was an early-2000s hacktool and Remote Access Trojan prominent in the retr... |
| schoolbus | Trojan | Sampled | Schoolbus (cataloged across security software as Backdoor:Win32/Schoolbus, Trojan.Win32.Schoolbus, and Backdoor.Schoolbus) is a classic early 2000s Remote Acces... |
| seed | Trojan | Sampled | Seed (cataloged across security software as Backdoor:Win32/Seed, Trojan.Win32.Seed, and Backdoor.Seed) is a stealthy, lightweight Remote Access Trojan developed... |
| serenity_rat | Rat | Sampled | Serenity RAT (cataloged across security software as Backdoor.Win32.Serenity, Trojan.Serenity, and Serenity RAT) is a mid-2000s Remote Access Trojan created in B... |
Threat intelligence confirms the following adversaries weaponize CVE-2012-0158 in enterprise intrusions and campaign toolkits:
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2012-0158 in enterprise networks:
RTF documents containing OLE CLSIDs {BDD1F04B-858B-11D1-B16A-00C0F0283628} or {C74190B6-8589-11D1-B16A-00C0F0283628} followed by shellcode bytes.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: InfoStealer Protection & Remediation →