New Campaign Uses Remcos RAT to Exploit Victims

CVE-2017-0199 Exploited by the Excel Document

CVE-2017-0199 is a Remote Code Execution vulnerability that exploits how Microsoft Office and WordPad parse specially crafted files.

In the background, the CVE-2017-0199 vulnerability is exploited to download an HTA file and execute it on the recipient’s device.

The CVE-2017-0199 vulnerability is exploited once the Excel file is opened on the victim’s device.

FortiGuard IPS service detects the vulnerability exploit against CVE-2017-0199 with the signature “MS.Office.OLE.autolink.Code.Execution”.