Technical intelligence and weaponization dossier for CVE-2013-3893. Documented exploitation across 2 active malware families totaling 38,195 analyzed telemetry samples.
| Vulnerability ID | CVE-2013-3893 |
|---|---|
| Common Name / Bulletin | Microsoft Internet Explorer SetCapture Use-After-Free Vulnerability (MS13-080) |
| CWE Classification | CWE-416: Use After Free in mshtml.dll |
| Affected Software & Versions | Microsoft Internet Explorer 6, 7, 8, 9, 10 |
| Technical Root Cause | Use-after-free in MSHTML when calling the SetCapture API on a DOM node that is concurrently freed, exploited zero-day in Asian water-holing attacks. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 2 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| zbot | Banking Trojan | 24,075 | Zbot (universally known as Zeus, and documented under variants such as Zeus Panda, GameOver Zeus, and Wsnpoem) is arguably the most influential banking trojan a... |
| zusy | Banking Trojan | 14,120 | Tinba (formally designated in AV classification as Zusy or IlliBanker, and colloquially celebrated as the 'Tiny Banker') is a notoriously compact banking trojan... |
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2013-3893 in enterprise networks:
Web telemetry capturing dynamic invocation of element.setCapture() inside onlosecapture event handlers accompanied by heap-spraying loops.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Active Incident Response Playbook →