Technical intelligence and weaponization dossier for CVE-2013-0074. Documented exploitation across 2 active malware families totaling 3,938 analyzed telemetry samples.
| Vulnerability ID | CVE-2013-0074 |
|---|---|
| Common Name / Bulletin | Microsoft Silverlight Double-Dereference Remote Code Execution (MS13-022) |
| CWE Classification | CWE-119: Memory Corruption |
| Affected Software & Versions | Microsoft Silverlight 5.0 |
| Technical Root Cause | Silverlight runtime flaw when validating object references, allowing web attackers to escape the browser sandbox via a malicious Silverlight application. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 2 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| bladabindi | Rat | 3,930 | Bladabindi (universally recognized in the cybersecurity community as njRAT) is an infamous, widely proliferated remote access trojan originally authored by an i... |
| simda | Botnet | 8 | Simda is a versatile, highly evasive modular botnet and credential-theft trojan first detected in 2009. Engineered with aggressive anti-analysis routines, sandb... |
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2013-0074 in enterprise networks:
Browser download of .xap packages from untrusted external IP addresses containing compiled .NET assemblies with obfuscated IL instructions.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Backdoor & RAT Protection for Businesses →