Loading story…
A large email campaign used malicious Microsoft Word RTF attachments to exploit CVE-2017-0199 and install the Dridex banking trojan on vulnerable systems. Researchers said the operation targeted millions of recipients across numerous organizations, primarily in Australia, using lures such as "Scan Data" and spoofed sender formats to make booby-trapped documents appear legitimate. Proofpoint identified the activity as a notable shift for Dridex operators, who had more commonly relied on macro-enabled documents, while McAfee, FireEye, and Ars Technica reported that the exploit worked broadly across Windows versions of Word and could bypass common exploit mitigations.
The attack was especially dangerous because it did not require macros and could execute even when Word presented warning dialogs; in many Protected View cases, users only needed to click Enable Editing for the infection chain to proceed. Successful exploitation reportedly installed Dridex botnet ID 7500, and Microsoft issued a patch for the flaw on April 11 after researchers warned that the zero-day had already been rapidly weaponized in the wild. Separately, Microsoft has also disclosed CVE-2026-35440, an Important Microsoft Word information disclosure flaw that requires user interaction and is assessed as less likely to be exploited, but it was not reported as publicly exploited.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Microsoft published advisory details for CVE-2026-35440, an Important Microsoft Word information disclosure vulnerability with a CVSS score of 5.5. The company said exploitation required user interaction, the Preview Pane was not an attack vector, the issue was not publicly disclosed or exploited, and a fix was available.
Microsoft released a security update for CVE-2017-0199 on April 11, 2017, after the flaw was weaponized in active Dridex spam campaigns. Researchers urged immediate patching because of the exploit's broad effectiveness across Word and Windows versions.
Proofpoint, along with other security firms including McAfee and FireEye, disclosed technical details of the campaign and said it marked the first Dridex activity they had observed using the newly disclosed Microsoft zero-day. They noted the exploit bypassed common mitigations, did not require macros, and could still succeed with minimal user interaction.
A large email campaign began using booby-trapped Word RTF documents exploiting CVE-2017-0199 to install the Dridex banking trojan. The campaign targeted millions of recipients across numerous organizations, primarily in Australia, and used lures such as "Scan Data."
Microsoft had reportedly known about the Microsoft Word remote-code-execution vulnerability later tracked as CVE-2017-0199 since January 2017, before public disclosure or a patch was issued.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcearstechnica.com
Open sourceproofpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers used **CVE-2017-0199** in malicious Microsoft Word and RTF documents to trigger the `hta` handler and pull follow-on payloads from attacker-controlled infrastructure, enabling code execution without relying on macros. One observed chain used a fake invoice attachment disguised as a `.doc` file to fetch a malicious HTA, then downloaded a Remcos RAT installer and an AutoIt-based persistence component over HTTPS from `streetsave[.]club` and `regwide[.]club`; the infected host later communicated with `darlz.freeddns[.]org` on port `1695`. Separate in-the-wild activity documented the same exploit delivering Visual Basic script stages that killed `winword.exe`, retrieved a payload disguised as an image, copied it as a Startup-folder `winword.exe`, and opened a decoy document to hide the intrusion. Researchers linked final payloads to **WingBird** and **FinFisher-like** malware, while other malicious documents delivered **LATENTBOT**; the campaigns relied on obfuscation, anti-analysis techniques, and persistence through registry Run keys or Startup-folder placement, underscoring the need to patch vulnerable Office systems.
Aug 15, 2026
Microsoft disclosed and patched multiple **actively exploited** vulnerabilities as part of its February security updates, including a Microsoft Word security feature bypass tracked as **CVE-2026-21514**. The Word flaw (CVSS 7.8; CWE-807) allows attackers to bypass **Object Linking and Embedding (OLE)**-related mitigations by abusing how Word makes security decisions based on untrusted inputs; exploitation is described as requiring a crafted document and **user interaction** (e.g., opening a phishing-delivered file) while avoiding typical prompts such as Protected View or “Enable Content” warnings. Microsoft also addressed an in-the-wild exploited Windows **Desktop Window Manager (dwm.exe)** elevation-of-privilege vulnerability, **CVE-2026-21519** (CVSS 7.8), which can allow a **local** attacker to escalate from a standard user context to **SYSTEM**. The February update review also lists additional exploited issues patched in the same release, including security feature bypasses in **Windows Shell (CVE-2026-21510)** and **Internet Explorer (CVE-2026-21513)**, plus other exploited vulnerabilities (e.g., **Windows Remote Desktop Services EoP CVE-2026-21533**), underscoring that defenders should prioritize rapid deployment of the February fixes across affected Windows and Office estates.
Jun 29, 2026
Microsoft has disclosed multiple **Microsoft Word remote code execution** flaws in its Security Update Guide, including `CVE-2026-40366`, `CVE-2026-40361`, and the earlier-listed `CVE-2026-33115`. The advisories identify all three issues as Word RCE vulnerabilities, indicating that specially crafted Word documents or related content could allow arbitrary code execution in affected environments. The newly published entries for `CVE-2026-40366` and `CVE-2026-40361` expand a growing set of Word security issues alongside `CVE-2026-33115`, underscoring continued risk around document-based attack paths in Microsoft Office. Organizations using Microsoft Word should review the corresponding Security Update Guide entries, prioritize patch deployment, and reinforce controls for untrusted document handling while assessing exposure across user endpoints.
Jul 12, 2026