New Campaign Uses Remcos RAT to Exploit Victims
FortiGuard IPS service detects the vulnerability exploit against CVE-2017-0199 with the signature “MS.Office.OLE.autolink.Code.Execution”.
5 passages name itOriginal (opens in a new tab) ↗
CVE-2017-0199 KEVRansomwarePublic exploit High · 7.8 EPSS 99.5%
Microsoft Office and WordPad Remote Code Execution Vulnerability
Microsoft · Office and WordPad
Official description · NVD
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
88.4 / 100
- Exploited
- Yes, in CISA KEV
- Reports
- 12
- Tactics
- 1/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 1 day before it was disclosed. Public exploit code (PoC-in-GitHub) appeared 1 day after disclosure.
- First seen exploitedVulnCheck KEV evidence1 day before
- Disclosedday 0
- Public exploit codePoC-in-GitHub+1 day
- First dated threat reporttrendmicro.com+2 mo
- Added to CISA KEVknown ransomware use; EU database agrees+5 yrs
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
2 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order, 5 cited passages 2ExecutionTA0002
Exploitation for Client Execution T1203 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
AI mapping from the description · primary impact
code runs via document exploitation; AnnoCTR expert entity-linking label (train split)
execute arbitrary code via a crafted document
CVE-2012-0158 CVE-2017-0199 CVE-2017-8759
Malicious File T1204.002 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
AI mapping from the description · how it is exploited
user opens crafted document
allow remote attackers to execute arbitrary code via a crafted document
Lower-confidence links (1)
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
- Exploit Public-Facing ApplicationT1190 needs user interaction; not a public-facing exploit
Detection
0 rules for this CVE · 74 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2017-0199 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Malicious FileT1204.00239 general rules
- Droppers Exploiting CVE-2017-11882criticalstable
- Ursnif Malware C2 URL Patterncriticalstable
- Exploit for CVE-2017-8759criticaltest
- Potential Maze Ransomware Activitycriticaltest
- File With Uncommon Extension Created By An Office Applicationhightest
- Flash Player Update from Suspicious Locationhightest
- GAC DLL Loaded Via Office Applicationshightest
- HackTool - LittleCorporal Generated Maldoc Injectionhightest
Exploitation for Client ExecutionT120335 general rules
- Antivirus - Exploitation Framework Signaturecriticalstable
- Droppers Exploiting CVE-2017-11882criticalstable
- Audit CVE Eventcriticaltest
- CVE-2021-31979 CVE-2021-33771 Exploitscriticaltest
- CVE-2021-31979 CVE-2021-33771 Exploits by Sourgumcriticaltest
- Exploit for CVE-2017-8759criticaltest
- Antivirus - APT Malware Signaturecriticalexperimental
- Antivirus - Remote Access Tools Signaturecriticalexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Named in 12 threat reports12 reportsProofpoint3Trend Micro3Fortinet+5Jun 2017 – Nov 2024 · 6 undated
Reports are matched by finding the exact id CVE-2017-0199 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Cobalt Strike: Favorite Tool from APT to Crimeware
2017 – [Microsoft Word Intruder Integrates CVE-2017-0199, Utilized by Cobalt Group to Target Financial…
Leviathan: Geostrategy and TTP (Tactics, Techniques and Procedures)
Mentions the CVE; no further detail.
Leviathan: Espionage Actor Targets Defense & Government
Exploitation: Microsoft Excel and Word documents with macros (sometimes password-protected), very recent vulnerabilities such as CVE-2017-0199 and CVE-2017-8759, and malicious Microsoft Publisher files…
5 passages name itOriginal (opens in a new tab) ↗
Show all 12 reportsShow fewer
Emails with Backdoor Targets Russian Businesses
These exploit a vulnerability (CVE-2017-0199) in Microsoft Office’s Windows Object Linking and Embedding (OLE) interface.
The Trail of BlackTech’s Cyber Espionage Campaigns
Mentions the CVE; no further detail.
LockBit Ransomware 2.0 Resurfaces
This technique employed by the attackers aligns with CVE-2017-0199.
2020 Financial Services and Insurance Industry Threat Report
CVE-2017-11882 JavaJavaScript CAPTCHA CVE-2018-8174 Compiled HTML File Autolt HTA Packager Shell Object IP Filtering Certutil CVE-2017-8570 Application Access Token Shortcut Fallout Exploit Kit CVE-2018-0802 Headers fencing XL4 macros CVE-2017-0199 CVE-2017-8759Lotus-Blue Toolkit (O365) Template Injection…
2 passages name itOriginal (opens in a new tab) ↗
Tech brief untangling the patchwork cyberespionage group
The PowerPoint (PPT) file exploits CVE-2017-0199, an RCE vulnerability in Microsoft Office’s Windows…
3 passages name itOriginal (opens in a new tab) ↗
Operation Wilted Tulip
The document exploited CVE-2017-0199, downloading an rtf file from:
2 passages name itOriginal (opens in a new tab) ↗
The Overlooked North Korean Actor
Mentions the CVE; no further detail.
2 passages name itOriginal (opens in a new tab) ↗
M-T RENDS2018
Mentions the CVE; no further detail.
Also mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- Trojan.PDF21 Oct 2026
- 44 more on OTX