CVSS 8.8 HIGH Bulletin: ADV210010 Published: 2021-09-09

CVE-2021-40444: Microsoft MSHTML Engine Remote Code Execution Vulnerability

Technical intelligence and weaponization dossier for CVE-2021-40444. Documented exploitation across 7 active malware families totaling 1,640 analyzed telemetry samples.

Attributed Families

Sample Volume

1,640

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Official NIST NVD

View NVD Record →

Vulnerability Specifications & Root Cause

Vulnerability ID	CVE-2021-40444
Common Name / Bulletin	Microsoft MSHTML Engine Remote Code Execution Vulnerability (`ADV210010`)
CWE Classification	`CWE-94: Improper Control of Generation of Code in MSHTML`
Affected Software & Versions	Microsoft Windows 7, 8.1, 10, 11, Server 2008 through 2022
Technical Root Cause	MSHTML browser rendering engine inside Office documents allowed malicious ActiveX controls to spawn arbitrary processes via CAB archive extraction and side-loading.
Associated ATT&CK Techniques	`T1204.002` — Associated ATT&CK Technique `T1566.001` — Associated ATT&CK Technique `T1574.002` — Associated ATT&CK Technique

Malware Families Weaponizing CVE-2021-40444

Empirical catalog telemetry verifies that the following 7 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:

7 families

Malware Family	Category	Catalog Samples	Operational Profile
pikabot	Loader	`850`	Pikabot is an evasive, modular malware loader that emerged in early 2023, widely recognized by threat intelligence analysts as one of the primary successors to ...
snake	Advanced Threat	`450`	Snake (also tracked across intelligence agencies and vendors as Turla, Uroburos, Ouroboros, and Snake Rootkit) is an exceptionally sophisticated cyber espionage...
redline	Infostealer	`120`	RedLine Stealer (cataloged across threat research as RedLine, RedLineStealer, and Trojan:Win32/RedLine) is the most ubiquitous and commercially successful infor...
icedid	Banking Trojan	`118`	IcedID (widely tracked across the intelligence community as BokBot) is a sophisticated modular banking trojan and initial access loader first identified in Sept...
formbook	Spyware	`35`	Formbook (rebranded in recent generations as XLoader) is a prolific, cross-platform information stealer and spyware implant offered on underground cybercrime fo...
bumblebee	Loader	`35`	Bumblebee is a sophisticated, enterprise-grade modular malware loader first discovered in March 2022 by Google Threat Analysis Group (TAG) and Proofpoint resear...
danabot	Banking Trojan	`32`	DanaBot is a sophisticated modular banking trojan, stealer, and loader platform first identified in May 2018 by Proofpoint security researchers. Authored in Emb...

Attributed Threat Actors & Syndicates

Threat intelligence confirms the following adversaries weaponize CVE-2021-40444 in enterprise intrusions and campaign toolkits:

FSB Center 16 — Attributed Threat Group / Campaign Operator
Secret Blizzard — Attributed Threat Group / Campaign Operator
TA577 — Attributed Threat Group / Campaign Operator
Turla — Attributed Threat Group / Campaign Operator

SOC Detection & Threat Hunting Guidance

Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2021-40444 in enterprise networks:

Office document relationships (.rels) referencing external mhtml: or http: URLs containing side.html or payload.cab; control.exe executing extracted INF files.

Remediation & Defensive Hardening

SOC containment checklist and attack surface reduction measures to neutralize exploitation:

Actionable Guidance: Install Sept 2021 cumulative update; disable installation of all ActiveX controls in Internet Explorer via registry key HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1001 (DWORD 3).

For end-to-end incident response procedures, consult our dedicated playbook: InfoStealer Protection & Remediation →

← Return to Vulnerability Matrix Directory (All 63 CVEs)