Technical intelligence and weaponization dossier for CVE-2014-0322. Documented exploitation across 2 active malware families totaling 14,121 analyzed telemetry samples.
| Vulnerability ID | CVE-2014-0322 |
|---|---|
| Common Name / Bulletin | Microsoft Internet Explorer CMarkup Use-After-Free (Operation SnowMan) (MS14-012) |
| CWE Classification | CWE-416: Use After Free |
| Affected Software & Versions | Microsoft Internet Explorer 9 and 10 |
| Technical Root Cause | Use-after-free in MSHTML CMarkup objects when processing memory references via Adobe Flash ActionScript heap-spray, weaponized zero-day by DarkHotel. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 2 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| zusy | Banking Trojan | 14,120 | Tinba (formally designated in AV classification as Zusy or IlliBanker, and colloquially celebrated as the 'Tiny Banker') is a notoriously compact banking trojan... |
| darkhotel | Backdoor | 1 | Backdoor:Win32/Darkhotel is an advanced, highly surgical cyber-espionage threat campaign and modular backdoor active since at least 2007, first publicly reveale... |
Threat intelligence confirms the following adversaries weaponize CVE-2014-0322 in enterprise intrusions and campaign toolkits:
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2014-0322 in enterprise networks:
Flash files hosted alongside SWF exploit payloads referencing memory offsets to CMarkup vftable addresses.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Backdoor & RAT Protection for Businesses →