Technical intelligence and weaponization dossier for CVE-2017-0199. Documented exploitation across 36 active malware families totaling 43,071 analyzed telemetry samples.
| Vulnerability ID | CVE-2017-0199 |
|---|---|
| Common Name / Bulletin | Microsoft Office / WordPad Remote Code Execution via Malicious OLE Moniker (MS17-012) |
| CWE Classification | CWE-94: Improper Control of Generation of Code in OLE2LINK |
| Affected Software & Versions | Microsoft Office 2007, 2010, 2013, 2016, Windows Vista, 7, 8.1, 10 |
| Technical Root Cause | Microsoft Word when parsing embedded OLE2LINK objects in RTF documents made an HTTP GET request to download an HTA script, executing mshta.exe without user prompting. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 36 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| emotet | Loader | 12,943 | Emotet (initially identified in 2014 as Geodo or Heodo) is historically recognized as one of the most destructive and costly botnet malware loaders ever observe... |
| fareit | Infostealer | 10,955 | Fareit (widely recognized across the threat intelligence community as Pony or Pony Stealer) is one of the most influential and pervasive credential-harvesting i... |
| ursnif | Banking Trojan | 8,188 | Ursnif (also widely known by its underlying codebase names Gozi and ISFB) is one of the most enduring and technically sophisticated banking trojans and modular ... |
| kovter | Trojan | 2,414 | Kovter is an extraordinarily evasive, polymorphic malware strain first detected in 2013. Initially engineered as a screen-locking police-impersonation ransomwar... |
| nanocore | Rat | 2,400 | NanoCore is an extensively proliferated, modular .NET-based Remote Access Trojan (RAT) originally created in 2013 by software developer Zachary Shames of Great ... |
| downloadhelper | Adware | 645 | DownloadHelper (cataloged across commercial antivirus telemetry as Adware:Win32/DownloadHelper, PUA.DownloadHelper, and Adware.Toolbar.DownloadHelper) is an int... |
| appster | Adware | 637 | Appster (recognized across cybersecurity solutions as Adware:Win32/Appster, PUA:Win32/Appster, and Adware.Appster) is an aggressive software bundler, monetizati... |
| softcnapp | Adware | 520 | Softcnapp (tracked across endpoint security engines as PUA:Win32/Softcnapp, Adware:Win32/Softcnapp, and PUP.Optional.Softcnapp) is a rogue application manager, ... |
| wizzmonetize | Adware | 515 | WizzMonetize (also tracked across threat intelligence feeds as Adware:Win32/WizzMonetize, PUA:Win32/WizzMonetize, and Adware.MonetizeInstaller) is an aggressive... |
| kuaizip | Adware | 483 | KuaiZip (cataloged across antimalware engines as PUA:Win32/KuaiZip, Adware:Win32/KuaiZip, and PUP.Optional.KuaiZip, also known as KuaiYa) is a rogue compression... |
| winactivator | Pua Tool | 409 | WinActivator (classified across cybersecurity solutions as HackTool:Win32/AutoKMS, HackTool:Win32/WinActivator, and PUA:Win32/KMSpico) is a widespread family of... |
| loadmoney | Adware | 398 | LoadMoney (cataloged across cybersecurity vendors as Adware:Win32/LoadMoney, PUA:Win32/LoadMoney, and PUP.Optional.LoadMoney) is a Russian-origin pay-per-instal... |
| ponystealer | Infostealer | 374 | Trojan:Win32/PonyStealer (universally recognized in cyber threat intelligence as Pony or Fareit) is a foundational credential theft trojan and stage-one botnet ... |
| wdfload | Advanced Threat | 358 | Wdfload (cataloged across security software as Trojan:Win32/Wdfload, Rootkit:Win32/Wdfload, and Trojan.Wdfload) is an advanced Windows rootkit and kernel-mode s... |
| driverpack | Pua | 326 | DriverPack (DriverPack Solution, recognized across endpoint security engines as PUA:Win32/DriverPack, Adware:Win32/DriverPack, and PUP.Optional.DriverPackSoluti... |
| nanobot | Rat | 306 | Backdoor:Win32/Nanobot is a modular, lightweight Remote Access Trojan (RAT) and stage-two loader engineered with an extremely compact on-disk footprint (typical... |
| daws | Ransomware | 246 | TrojanDownloader:Win32/Daws (cataloged across security vendors as Trojan.Daws or Ransom.Daws) is a persistent Windows trojan downloader and stage-one ransomware... |
| remcos | Rat | 198 | Remcos (an acronym for 'Remote Control & Surveillance') is a feature-rich, commercial Remote Access Trojan first released in 2016 by Italian software developer ... |
| spygate | Rat | 127 | Backdoor:Win32/Spygate (widely known as SpyGate-RAT) is a prominent, commercial Remote Access Trojan builder developed in .NET and Visual Basic that emerged in ... |
| goznym | Banking Trojan | 120 | Trojan:Win32/Goznym is a devastating hybrid banking trojan created in early 2016 through the engineering merger of two notorious malware codebases: the Nymaim s... |
| ardamax | Infostealer | 114 | PWS:Win32/Ardamax (commercially branded as Ardamax Keylogger) is a surveillance tool originally created in 2004 as commercial employee and parental monitoring s... |
| gozi | Banking Trojan | 113 | Trojan:Win32/Gozi (also universally tracked as ISFB and the Ursnif family tree) is one of the most historically significant, resilient banking trojans in comput... |
| dridex | Banking Trojan | 59 | Dridex (also known as Bugat v5, Cridex, and Dridex Banking Trojan) is an infamous, highly sophisticated banking trojan and modular malware framework first docum... |
| lokibot | Infostealer | 55 | LokiBot (also designated as Loki PWS) is a widely proliferated commodity information stealer and keylogger first observed in 2015. Authored by an underground de... |
| netwire | Rat | 55 | NetWire (cataloged across threat research as NetWire RAT, NetWire.RC, Backdoor:Win32/Netwire, and Trojan.Netwire) is a cross-platform remote access trojan (RAT)... |
| turla | Advanced Threat | 35 | Turla (extensively documented in military and threat intelligence reporting under aliases such as Snake, Uroburos, Waterbug, and Venomous Bear) is an elite cybe... |
| smokeloader | Loader | 21 | SmokeLoader (also cataloged in threat telemetry as Dofoil or Sharapov) is a veteran modular malware loader and botnet first commercialized in 2011 by an undergr... |
| troldesh | Ransomware | 14 | Troldesh (widely tracked across the intelligence community as Shade or Encrypter.JPHP) is a notorious Russian-speaking ransomware family first active in late 20... |
| locky | Ransomware | 11 | Locky is one of the most prolific, damaging, and aggressively distributed ransomware strains in cyber history, first emerging in February 2016. Associated with ... |
| pony | Infostealer | 10 | Pony (cataloged across cybersecurity authorities as Fareit, Siplog, Trojan:Win32/Fareit, and PWS:Win32/Fareit) is one of the most prolific commodity information... |
| plugx | Rat | 8 | PlugX (also known across threat intelligence teams as Korplug or Sogu) is an exceptionally sophisticated, highly modular Remote Access Trojan first observed in ... |
| hermes | Ransomware | 7 | Ransom:Win32/Hermes is a targeted, destructive ransomware strain first observed in early 2017 across Russian cybercrime underground forums. In October 2017, Her... |
| gh0st | Rat | 4 | Gh0st RAT (also tracked as Ghost RAT, Backdoor.Gh0st, and Win32/Gh0st) is one of the most historically significant, modular, and widely weaponized Remote Access... |
| necurs | Spam Bot | 2 | Botnet:Win32/Necurs was one of the largest, most pervasive botnet infrastructures in cybercrime history, comprising over 9 million compromised computers across ... |
| darkhotel | Backdoor | 1 | Backdoor:Win32/Darkhotel is an advanced, highly surgical cyber-espionage threat campaign and modular backdoor active since at least 2007, first publicly reveale... |
| bandook | Rat | Sampled | Bandook (derived from the Arabic and Hindi word for 'gun' or 'rifle') is an enduring, modular Remote Access Trojan first created in 2005 by Lebanese software au... |
Threat intelligence confirms the following adversaries weaponize CVE-2017-0199 in enterprise intrusions and campaign toolkits:
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2017-0199 in enterprise networks:
Sysmon Event ID 1: WINWORD.EXE or WORDPAD.EXE spawning mshta.exe, powershell.exe, or cscript.exe; RTF files containing the string 'rtf1' and 'oleObject' with embedded HTTP URLs.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Ransomware Containment & Incident Response →