Loading story…
Check Point Research identified more than 13,000 malicious Microsoft Office document samples in 2023 exploiting CVE-2017-11882, CVE-2017-0199, and CVE-2018-0802, demonstrating continued abuse of years-old vulnerabilities. The documents supported Gamaredon APT operations and delivered malware including Agent Tesla, GuLoader, and FormBook/Xloader, targeting sectors including finance and banking, government, and healthcare. Most samples circulated for less than a week, and some initially attracted very few security detections. Attackers used social-engineering lures, encrypted Excel files, unusual URL representations, obfuscated shellcode and VBA macros, and oversized OLE objects to hinder detection and analysis.
Earlier Unit 42 research documented active exploitation of CVE-2017-11882, a stack buffer overflow in Microsoft Equation Editor that enables remote code execution through crafted RTF documents. The vulnerable component lacked modern exploit mitigations such as DEP and ASLR, and attackers used email attachments and legitimate Windows utilities to retrieve or execute payloads; one fake-invoice campaign delivered FormBook. Organizations should prioritize Office and operating-system updates, apply the relevant Microsoft patches or disable vulnerable Equation Editor installations, and reinforce controls and employee awareness around unexpected attachments and links.
See which actors are running it and whether you're in range.
9 events from the most recent confirmed update back to the earliest known activity.
Check Point Research identified more than 13,000 samples in the wild during 2023 exploiting CVE-2017-11882, CVE-2017-0199, and CVE-2018-0802. The documents distributed malware including Agent Tesla, GuLoader, and Formbook/Xloader, with finance/banking, government, and healthcare among the targeted sectors.
A malicious-document campaign exploited CVE-2017-11882 to distribute GuLoader, a shellcode-based downloader used to deliver additional malware.
Attackers exploited CVE-2017-11882 in malicious email campaigns during the COVID-19 pandemic in 2020. The emails used delivery disruptions caused by pandemic restrictions as a lure to persuade recipients to open malicious Office documents.
Unit 42 reported detecting thousands of attacks exploiting CVE-2017-11882 beginning November 20. Attackers used malicious documents and utilities such as mshta.exe, cscript.exe, and regsvr32.exe to execute remote payloads.
Microsoft released a patch for CVE-2017-11882, a stack buffer overflow in Equation Editor that permits remote code execution when a specially crafted document is opened.
A proof of concept for CVE-2017-11882 appeared online less than a week after its disclosure in late 2017. Exploitation attempts began within the following few days.
Attackers exploited CVE-2017-0199 in malicious Microsoft Office documents to distribute Dridex.
Check Point Research linked a CVE-2017-0199 document to Gamaredon operations and documented evasion techniques including encrypted Excel files, obscured URLs, and obfuscated shellcode. Researchers also examined a document containing an approximately 2 GB OLE object and obfuscated VBA, while explicitly noting that they lacked direct proof that this particular document was malicious.
Unit 42 identified a campaign distributing fake invoice documents to European organizations. The documents exploited CVE-2017-11882 and delivered the FormBook information-stealing Trojan through a PowerShell script.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 79 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
research.checkpoint.com
Open sourcekaspersky.com
Open sourceusa.kaspersky.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft documented **CVE-2021-40444** as a remote code execution flaw in the MSHTML engine that could be triggered through specially crafted Microsoft Office documents, and security reporting tied the issue to attachment-based phishing campaigns. MITRE ATT&CK maps this activity to **`T1566.001` Spearphishing Attachment**, a technique widely used by both state-backed and criminal actors to gain initial access through Word, Excel, RTF, PDF, archive, and shortcut files sent by email. Security telemetry and malware analysis showed how the technique translated into real-world intrusion activity. A suspicious Word document sample analyzed in ANY.RUN and Trustwave reporting on a trojanized OneNote lure illustrate the broader pattern of weaponized Office attachments being used to execute payloads such as **FormBook**. Splunk also published detection guidance for spotting Office processes loading **`mshtml.dll`**, noting that such module loads can indicate exploitation of **CVE-2021-40444** and may precede arbitrary code execution, data theft, or deeper compromise.
Aug 15, 2026
`CVE-2017-11882` is a Microsoft Office memory corruption flaw in the legacy Equation Editor that enables arbitrary code execution in the context of the current user when a victim opens a crafted document. The vulnerability affects Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, and Office 2016, and public exploit material quickly emerged showing how malicious RTF files could trigger remote command execution or shellcode execution, including Metasploit support and techniques that leveraged `mshta.exe` or injected payloads into `EQNEDT32.EXE`. The flaw was also used in phishing operations to deliver malware. One documented campaign used malicious Office documents exploiting `CVE-2017-11882` alongside `CVE-2017-0199` to deploy the LokiBot stealer through a multi-stage chain involving encrypted Excel files, embedded OLE objects, and follow-on document retrieval. Investigation of the campaign exposed misconfigured attacker infrastructure, including a publicly accessible `phpinfo.php` page on `192.3.239.42`, a host identified as `WIN-2NF07F1AQLT`, and OSINT links to additional infrastructure and Brazil-registered scam domains tied to the operation.
Aug 15, 2026
Threat actors are increasingly leveraging weaponized document formats and add-ins to compromise Windows users, with recent campaigns targeting organizations in multiple countries. One operation uncovered by researchers used phishing emails with RAR archives containing obfuscated JavaScript payloads, which exploited the CVE-2017-11882 vulnerability in Microsoft Office's Equation Editor. The infection chain included the use of malicious SVG files, ZIP archives with LNK shortcuts, and a sophisticated four-stage execution pipeline involving steganographically embedded .NET assemblies and the abuse of legitimate open-source libraries, all designed to evade detection and deliver commodity loaders for Remote Access Trojans and information stealers. Separately, attackers have been abusing Microsoft Excel's XLL add-in format to deliver malware, with a notable increase in such activity since 2021. Recent incidents include the submission of malicious XLL files to VirusTotal from Ukraine and Russia, which contained a backdoor named EchoGather capable of system reconnaissance, command execution, and file transfer. These XLL-based attacks often use open-source frameworks like Excel-DNA to facilitate payload delivery and in-memory execution, further complicating detection and mitigation efforts for targeted organizations.
Jun 29, 2026