Technical intelligence and weaponization dossier for CVE-2014-1761. Documented exploitation across 11 active malware families totaling 65,920 analyzed telemetry samples.
| Vulnerability ID | CVE-2014-1761 |
|---|---|
| Common Name / Bulletin | Microsoft Word RTF Parsing Memory Corruption (MS14-017) (MS14-017) |
| CWE Classification | CWE-119: Memory Corruption |
| Affected Software & Versions | Microsoft Word 2003, 2007, 2010, 2013, Word Viewer |
| Technical Root Cause | Malformed file format parsing in Microsoft Word when handling RTF documents containing malicious 'listoverride' or OLE structures, exploited in high-profile cyber espionage. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 11 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| xtrat | Rat | 35,969 | Xtreme RAT (widely tracked as xtrat or xrat) is a feature-complete, commercial-grade remote access trojan that first surfaced in late 2010. Engineered originall... |
| ramnit | Worm Banker | 20,595 | Ramnit (also known as Nimnul or Cosmu) is a devastating, multi-faceted banking trojan and worm that first emerged in 2010. Originally conceived as a Windows fil... |
| upatre | Downloader | 4,200 | Upatre is a notoriously lightweight, high-volume downloader first identified in mid-2013 that served as the initial spearhead for some of the most catastrophic ... |
| bladabindi | Rat | 3,930 | Bladabindi (universally recognized in the cybersecurity community as njRAT) is an infamous, widely proliferated remote access trojan originally authored by an i... |
| nymaim | Downloader | 756 | Nymaim is a sophisticated dual-stage malware downloader and loader first observed in 2013. Designed with extreme resilience, Nymaim specialized in evading secur... |
| poison | Rat | 261 | Poison Ivy (widely known across threat intelligence teams as PIVY) is one of the most historically significant and enduring Remote Access Trojans (RATs) in cybe... |
| salgorea | Backdoor | 135 | Salgorea (cataloged across advanced threat intelligence reports as Backdoor.Win32.Salgorea, BadCake, and Trojan:Win32/Salgorea) is a sophisticated targeted cybe... |
| vawtrak | Banking Trojan | 50 | Vawtrak (widely cataloged across international law enforcement and intelligence communities as Neverquest or Snifula) is one of the most damaging banking trojan... |
| chthonic | Banking Trojan | 14 | Trojan:Win32/Chthonic is an advanced, highly modular banking trojan and direct evolutionary offshoot of the Zeus (Zbot) codebase discovered by Kaspersky Lab res... |
| plugx | Rat | 8 | PlugX (also known across threat intelligence teams as Korplug or Sogu) is an exceptionally sophisticated, highly modular Remote Access Trojan first observed in ... |
| carbanak | Banking Trojan | 2 | Carbanak (also cataloged across international law enforcement and intelligence communities as Anunak) is an elite, multi-million dollar cyber heist malware fram... |
Threat intelligence confirms the following adversaries weaponize CVE-2014-1761 in enterprise intrusions and campaign toolkits:
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2014-1761 in enterprise networks:
YARA: strings $a = "\listoverridecount" and $b = "\ls1" in RTF files with excessive null byte sequences.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Backdoor & RAT Protection for Businesses →