Technique:  Exploitation for Client Execution
It has exploited client software vulnerabilities for execution, such as Microsoft Word CVE-2012-0158.
Agent Tesla has exploited Office vulnerabilities such as CVE-2017-11882 and CVE-2017-8570 for execution during delivery.
It has exploited numerous ActiveX vulnerabilities, including zero-days.
It has exploited CVE-2012-0158 and CVE-2010-3333 for execution against targeted systems.
It has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities (CVE-2009-3129, CVE-2012-0158) and vulnerabilities in Adobe Reader and Flash (CVE-2009-4324, CVE-2009-0927, CVE-2011-0609, CVE-2011-0611).
It has exploited Microsoft Office vulnerability CVE-2017-0262 for execution.
It has used multiple software exploits for common client software, like Microsoft Word, Exchange, and Adobe Reader, to gain code execution.
It has exploited the Adobe Flash Player vulnerability CVE-2015-3113 and Internet Explorer vulnerability CVE-2014-1776.
It has used RTF document that includes an exploit to execute malicious code. (CVE-2017-11882)
It has attempted to exploit a known vulnerability in WinRAR (CVE-2018-20250), and attempted to gain remote code execution via a security bypass vulnerability (CVE-2017-11774).
It has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.
It leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.
It has used exploits for multiple vulnerabilities including CVE-2014-0322, CVE-2012-4792, CVE-2012-1889, and CVE-2013-3893.
Bankshot leverages a known zero-day vulnerability in Adobe Flash to execute the implant into the victims’ machines.
It has exploited Microsoft Office vulnerabilities CVE-2012-0158, CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802.
It has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119.
It has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.
It had exploited multiple vulnerabilities for execution, including Microsoft’s It Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.
Cobalt Strike can exploit Oracle Java vulnerabilities for execution, including CVE-2011-3544, CVE-2013-2465, CVE-2012-4681, and CVE-2013-2460.
It has exploited Microsoft Office vulnerabilities, including CVE-2015-1641, CVE-2017-11882, and CVE-2018-0802.
It has exploited Adobe Flash vulnerability CVE-2015-8651 for execution.
DealersChoice leverages vulnerable versions of Flash to perform execution.
It has exploited CVE-2011-0611 in Adobe Flash Player to gain execution on a targeted system.
It has used exploitation of endpoint software, including Microsoft Internet Explorer Adobe Flash vulnerabilities, to gain execution. They have also used zero-day exploits.
It has exploited Microsoft Office vulnerability CVE-2017-11882.
EvilBunny has exploited CVE-2011-4369, a vulnerability in the PRC component in Adobe Reader.
It has used malicious documents containing exploits for CVE-2021-40444 affecting Microsoft MSHTML.
During Frankenstein, the threat actors exploited CVE-2017-11882 to execute code on the victim's machine.
HAWKBALL has exploited Microsoft Office vulnerabilities CVE-2017-11882 and CVE-2018-0802 to deliver the payload.
It has exploited CVE-2018-0798 for execution.
It has exploited CVE-2012-0158, CVE-2014-1761, CVE-2017-11882 and CVE-2018-0802 for execution.
InvisiMole has installed legitimate but vulnerable Total Video Player software and wdigest.dll library drivers on compromised hosts to exploit stack overflow and input validation vulnerabilities for code execution.
It has exploited Adobe Flash vulnerability CVE-2018-4878 for execution.
It has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.
It has exploited the Office vulnerability CVE-2017-0199 for execution.
It has exploited CVE-2017-0199 in Microsoft Word to execute code.
During Operation Dust Storm, the threat actors exploited Adobe Flash vulnerability CVE-2011-0611, Microsoft Windows Help vulnerability CVE-2010-1885, and several Internet Explorer vulnerabilities, including CVE-2011-1255, CVE-2012-1889, and CVE-2014-0322.
It uses malicious documents to deliver remote execution exploits as part of. The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.
Ramsay has been embedded in documents exploiting CVE-2017-0199, CVE-2017-11882, and CVE-2017-8570.
It has exploited vulnerabilities in Microsoft PowerPoint via OLE objects (CVE-2014-4114) and Microsoft Word via crafted TIFF images (CVE-2013-3906).
It has exploited vulnerabilities to gain execution including CVE-2017-11882 and CVE-2020-0674.
SpeakUp attempts to exploit the following vulnerabilities in order to execute its malicious script: CVE-2012-0874, CVE-2010-1871, CVE-2017-10271, CVE-2018-2894, CVE-2016-3088, JBoss AS 3/4/5/6, and the Hadoop YARN ResourceManager.
SUPERNOVA was installed via exploitation of a SolarWinds Orion API authentication bypass vulnerability (CVE-2020-10148).
It has exploited Microsoft Word vulnerability CVE-2017-0199 for execution.
It has taken advantage of a known vulnerability in Microsoft Word (CVE 2012-0158) to execute code.
It has exploited CVE-2018-0798 in It Editor.
It has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.
It has crafted malicious files to exploit CVE-2012-0158 and CVE-2010-3333 for execution.
It has executed commands through Microsoft security vulnerabilities, including CVE-2017-11882, CVE-2018-0802, and CVE-2012-0158.
Woody RAT has relied on CVE-2022-30190 (Follina) for execution during delivery.
Xbash can attempt to exploit known vulnerabilities in Hadoop, Redis, or ActiveMQ when it finds those services running in order to conduct further execution.