Operation Cloud Hopper: Technical Annex

pwc.co.uk · Undated · Licence: not cleared; local research copy only

CVEs this report names

1 CVE

CVE-2012-0158Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability
Microsoft · MSCOMCTL.OCXKEVRansomwarePublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution15 reports
>99.9%Top 0.02%
89.2priority

Where it names them

CVE-2012-0158

Taiwan president election watching group schedule”.2 Once the spreadsheet is opened, CVE- 2012-0158 is exploited and a file called 6EC5.tmp is dropped in the %TEMP% folder.

Original ↗

Techniques drawn from this report

None

No passage in this report has been tied to an ATT&CK technique.