Four Element Sword, weaponized document builder used by APTs

CVE-2012-0158 is a remote code execution flaw in Microsoft's MSCOMCTL.OCX, the Windows Common Controls ActiveX component, where improper handling of crafted input allows memory corruption and code execution. It is typically triggered when an application that uses the control (most commonly Microsoft Office) processes specially crafted content, such as a malicious document or file, meaning a victim usually has to open attacker-supplied content. Successful exploitation lets an attacker run arbitrary code and take complete control of the affected system with the privileges of the current user. Any Windows system carrying a vulnerable copy of MSCOMCTL.OCX — including systems where the control was redistributed by legacy applications — is affected, which makes the potential population very large. Exploitation is confirmed and ongoing: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, and EPSS assigns it the maximum reported probability of exploitation within 30 days.

Do: Apply the Microsoft security update for MSCOMCTL.OCX (per vendor instructions, per CISA's required action) on all systems, prioritizing endpoints and servers that open Office documents. Because exploitation commonly arrives via malicious documents, treat unsolicited Office/RTF attachments with suspicion and verify that applications that redistribute MSCOMCTL.OCX have installed a patched copy. Scan the estate for the presence and version of MSCOMCTL.OCX, especially on legacy Windows/Office installations that may be missed by routine patching.

CVE-2012-1856 is a remote code execution flaw in the TabStrip ActiveX control in the Common Controls library (MSCOMCTL.OCX) that ships with Microsoft Office, classified as code injection (CWE-94). An attacker triggers it by getting a victim to open a specially crafted document or browse to a crafted web page that instantiates the control and corrupts the system state, allowing arbitrary code execution in the context of the user. Successful exploitation gives the attacker the privileges of the logged-on user, enabling malware delivery or lateral movement, which matches the weaponized-document patterns seen in APT campaigns referenced in related reporting. Any user of Microsoft Office where the vulnerable control is present and loadable from untrusted documents or web content is affected. Exploitation is confirmed in the wild: the flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03) and EPSS assigns a 72.2% probability of exploitation within 30 days (99th percentile), though no public proof-of-concept code is known.

Do: Apply Microsoft's Office security updates per vendor instructions, as required by the CISA KEV catalog, and verify on legacy systems that MSCOMCTL.OCX has actually been updated rather than assumed. Restrict or prompt on ActiveX control instantiation from untrusted documents and web pages, and hunt for spearphishing documents or web content that exercises the TabStrip control, given the APT and malware-tooling activity noted in related reporting.

Microsoft Office contains a memory corruption flaw (CWE-399) in its handling of Rich Text Format (RTF) files, allowing a crafted RTF document to corrupt memory when the file is parsed. The flaw is triggered by opening a specially crafted RTF file — typically delivered as an email attachment — in an affected version of Microsoft Office. Successful exploitation yields remote code execution in the context of the current user, so attacker privilege is limited to the rights of the logged-in account. Per the CISA data, Microsoft Office is the affected product, with no specific version ranges provided; the flaw was fixed in Microsoft's April 2015 Patch Tuesday security updates (MS15-033), so risk is concentrated on systems that never applied those updates. Exploitation is confirmed in the wild — the CVE was added to the CISA KEV on 2021-11-03 (ransomware use unknown) — it carries a 96.8% EPSS probability of exploitation within 30 days (100th percentile), and related reporting links RTF exploit techniques of this era to targeted APT campaigns (e.g., the T9000 backdoor and DragonOK tooling).

Do: Apply Microsoft's April 2015 Office security updates (MS15-033) on all endpoints, per the CISA KEV required action, prioritizing hosts running older Office editions, and verify installation via installed-updates checks. As interim hardening, treat inbound RTF files with suspicion (block or sandbox RTF email attachments) and monitor for suspicious child processes spawned by Word (e.g., Winword.exe launching cmd.exe or PowerShell) to detect possible prior exploitation. Organizations still on legacy Office versions should upgrade to currently supported editions that receive ongoing security updates.

CVE-2015-1770 is a use of uninitialized memory flaw in Microsoft Office that can lead to remote code execution. It is triggered when a user is convinced to open a crafted Office document, causing Office to process uninitialized memory in a way an attacker can leverage. A successful attacker gains the ability to execute arbitrary code in the context of the current user. Any environment running affected Microsoft Office builds, particularly legacy or unpatched installations, is affected. The flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-28), indicating known in-the-wild exploitation; EPSS estimates a 35.1% probability of exploitation in the next 30 days (98th percentile), and no public PoC is known.

Do: Apply Microsoft's updates for CVE-2015-1770 across all Office installations per vendor instructions, prioritizing systems handling untrusted documents given the KEV listing. Audit legacy or infrequently updated Office builds with patch inventories to confirm the fix is present. Until patched, have users avoid opening Office files from untrusted sources and consider hardening or disabling document preview and auto-open flows.