CVSS 9.3 CRITICAL Bulletin: MS14-060 Published: 2014-10-14

CVE-2014-4114: Microsoft Windows OLE Package Packager Remote Code Execution (Sandworm)

Technical intelligence and weaponization dossier for CVE-2014-4114. Documented exploitation across 5 active malware families totaling 471 analyzed telemetry samples.

Attributed Families

Sample Volume

471

CVSS Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Official NIST NVD

View NVD Record →

Vulnerability Specifications & Root Cause

Vulnerability ID	CVE-2014-4114
Common Name / Bulletin	Microsoft Windows OLE Package Packager Remote Code Execution (Sandworm) (`MS14-060`)
CWE Classification	`CWE-94: Remote Code Execution via OLE Object Packaging`
Affected Software & Versions	Microsoft Windows Vista, 7, 8, Server 2008, Server 2012
Technical Root Cause	Windows packager.dll allowed weaponized PowerPoint (PPSX) files to download and execute arbitrary INF files from WebDAV shares, weaponized by Sandworm Team.
Associated ATT&CK Techniques	`T1204.002` — Associated ATT&CK Technique `T1566.001` — Associated ATT&CK Technique `T1105` — Associated ATT&CK Technique

Malware Families Weaponizing CVE-2014-4114

Empirical catalog telemetry verifies that the following 5 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:

5 families

Malware Family	Category	Catalog Samples	Operational Profile
zegost	Rat	`441`	Trojan:Win32/Zegost (widely documented by threat researchers as Backdoor.Zegost or Zegost RAT) is a sophisticated cyber espionage Remote Access Trojan and rootk...
babar	Advanced Threat	`14`	Trojan:Win32/Babar is a highly sophisticated, nation-state cyber-espionage implant attributed by international intelligence agencies and cybersecurity researche...
chthonic	Banking Trojan	`14`	Trojan:Win32/Chthonic is an advanced, highly modular banking trojan and direct evolutionary offshoot of the Zeus (Zbot) codebase discovered by Kaspersky Lab res...
blackenergy	Advanced Threat	`1`	BlackEnergy is an advanced, modular persistent threat (APT) framework originally authored in 2007 by Ukrainian hacker Dmytro Oleksiuk (alias 'Cr4sh') as an unde...
killdisk	Wiper	`1`	Trojan:Win32/KillDisk is a catastrophic industrial wiper malware family developed and deployed by Russian military intelligence hackers belonging to the Russian...

Attributed Threat Actors & Syndicates

Threat intelligence confirms the following adversaries weaponize CVE-2014-4114 in enterprise intrusions and campaign toolkits:

Animal Farm APT — Attributed Threat Group / Campaign Operator
East Asian State-Sponsored APT Groups — Attributed Threat Group / Campaign Operator
Russian Cybercrime Syndicates — Attributed Threat Group / Campaign Operator
Russian GRU Unit 74455 (Sandworm) — Attributed Threat Group / Campaign Operator
Zeus Variant Operators — Attributed Threat Group / Campaign Operator

SOC Detection & Threat Hunting Guidance

Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2014-4114 in enterprise networks:

Process creation: powerpnt.exe invoking packager.dll to drop and execute .inf setup scripts via advpack.dll / infDefaultInstall.

Remediation & Defensive Hardening

SOC containment checklist and attack surface reduction measures to neutralize exploitation:

Actionable Guidance: Apply MS14-060 patch; block outbound WebDAV (HTTP/HTTPS over non-standard external ports) and disable WebClient service.

For end-to-end incident response procedures, consult our dedicated playbook: Backdoor & RAT Protection for Businesses →

← Return to Vulnerability Matrix Directory (All 63 CVEs)