Researchers Share New Insights Into RIG Exploit Kit Malware's Operations

CVE-2013-2551 is a use-after-free memory corruption flaw (CWE-416) in Microsoft Internet Explorer. An attacker triggers it by luring a user to a crafted website that causes the browser to access an object that has already been deleted from memory. Successful exploitation allows the attacker to execute arbitrary code on the victim machine, typically in the context of the logged-in user. All Internet Explorer deployments are potentially affected; the source data does not specify version ranges, but the flaw is best known as a long-lived legacy-browser issue exploited by drive-by exploit kits. The vulnerability is confirmed to be exploited in the wild: it is listed in CISA KEV (added 2022-03-28) with known ransomware use, and EPSS assigns it a 74.1% probability of exploitation in the next 30 days (99th percentile).

Do: Apply Microsoft updates for Internet Explorer per vendor instructions, as required by the CISA KEV listing, prioritizing any Windows systems still using IE or IE-based components. As interim mitigation, restrict browsing to trusted sites and ensure users are not running as administrators for routine web activity. Audit legacy environments for obsolete IE usage and migrate those systems to a supported, actively patched browser where updates are no longer feasible.

CVE-2014-6332 is a memory-corruption flaw (CWE-119) in OleAut32.dll, the OLE Automation component shipped with Microsoft Windows, in which OLE automation arrays are mishandled, allowing out-of-bounds memory access. A remote attacker triggers it by luring a user to a crafted website whose script (typically executed through Internet Explorer) calls into the vulnerable OLE Automation code, corrupting memory on the victim machine. Successful exploitation yields remote code execution with the privileges of the logged-on user, generally giving the attacker full control of the workstation. Because OleAut32.dll is a core OS component, essentially every Windows client and server in circulation at the time was affected; Microsoft addressed it in the November 2014 security updates (MS14-064). The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-25), indicating known in-the-wild exploitation, and EPSS assigns a 95% probability of exploitation within 30 days (100th percentile); no public PoC is tracked in the source data.

Do: Apply Microsoft's November 2014 Windows/OLE security updates (MS14-064) across all Windows clients and servers, prioritizing internet-facing systems and workstations used for web browsing, and confirm the patched OleAut32.dll is present via patch-management or vulnerability-scanner checks. Because the flaw is KEV-listed and exploitable in a drive-by web-attack scenario, treat any remaining unpatched Windows host as high risk and isolate legacy systems that cannot be updated.

CVE-2015-0313 is a use-after-free (CWE-416) flaw in Adobe Flash Player that allows remote attackers to execute arbitrary code. It is triggered when the Flash browser plugin processes specially crafted Flash/SWF content, commonly delivered through a malicious or malvertising-loaded web page or exploit kit, causing the plugin to reference freed memory. A successful attack yields code execution in the context of the logged-in user, which related 2015 coverage links to exploit kit (e.g., RIG) and malvertising campaigns delivering ransomware. Anyone running a then-current Adobe Flash Player in a browser was affected; the source data does not specify exact version ranges. The flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-04-13), has an EPSS exploitation probability of 95.3% (100th percentile), and should be treated as actively exploited in the wild.

Do: Apply Adobe's January 2015 emergency security bulletin (APSB15-04), which addressed this flaw, if any system must still run Flash; otherwise upgrade to the latest available patched release. Because Flash is end-of-life, CISA's required action is to disconnect or fully remove/uninstall Flash wherever it is still in use. Audit browsers, legacy web applications, and any software that renders SWF content, and review endpoint logs for exploit kit or malvertising-driven infections.

CVE-2015-2419 is a memory corruption flaw (CWE-119) in the JScript engine used by Microsoft Internet Explorer, allowing remote attackers to execute arbitrary code or cause a denial of service through a crafted website. It is triggered when a user visits an attacker-controlled page whose JScript content corrupts memory in the affected browser process. A successful attacker gains remote code execution in the context of the logged-on user (or crashes the browser), which makes drive-by and exploit-kit delivery routes viable. Any Windows user running the affected versions of Internet Explorer at the time of disclosure was exposed, and Microsoft shipped fixes as part of its July 2015 security updates. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-28), carries a 53.4% EPSS (99th percentile), and related reporting places it among the top vulnerabilities used by exploit kits in 2015-2016.

Do: Apply Microsoft's July 2015 security updates for Internet Explorer per vendor instructions, as required by the CISA KEV catalog, and verify that any legacy Windows systems still running Internet Explorer have received them. Because exploitation typically occurs via drive-by web attacks, retire or fully patch IE on client endpoints and keep endpoint protection enabled to catch exploit-kit delivery. Confirm no workstations remain on unpatched IE builds, since this entry has been in CISA KEV since March 2022 and exploitation probability remains high (EPSS 53.4%).

CVE-2016-0189 is a memory corruption flaw (out-of-bounds write, per CWE-787) in Microsoft's JScript 5.8 and VBScript 5.7/5.8 scripting engines, as used in Internet Explorer 9 through 11 and other products that embed those engines. It is triggered remotely when a user is lured into viewing a crafted website that mishandles script, corrupting memory in the browser process. A successful attacker gains arbitrary code execution in the context of the current user (or can crash the browser, causing denial of service), with no authentication required but user interaction needed. Anyone running Internet Explorer 9-11 on Windows, or other products using the affected scripting engines, was exposed. Exploitation is well established: public write-ups document its use in drive-by exploit kit attacks and subsequent 'God Mode' local privilege-escalation variants, it is listed in CISA KEV (added 2022-03-28) with known ransomware use, and EPSS assigns a 94.1% probability of exploitation within 30 days.

Do: Apply the vendor-supplied Microsoft security updates for Internet Explorer and the JScript/VBScript scripting engines per CISA's required action, prioritizing endpoints used for web browsing and email since this is delivered via drive-by website attacks and is known to be used by ransomware operators. Systems that no longer receive updates for IE 9-11 should be migrated to a supported browser or OS. Check your environment against CISA KEV to confirm remediation status.

CVE-2018-8174 is an out-of-bounds write (CWE-787) in the Microsoft Windows VBScript engine, caused by the way it handles objects in memory. An attacker triggers it by convincing a user to visit a specially crafted website or open crafted content that invokes the VBScript engine (for example via Internet Explorer or a document preview), requiring user interaction. Successful exploitation yields remote code execution with the privileges of the logged-on user, enabling program installation, data theft and account takeover. All listed Windows client and server releases are affected: Windows 7, 8.1, RT 8.1, Windows 10 (1607-1803), and Windows Server 2008/2008 R2, 2012/2012 R2, 2016. Exploitation is in the wild: the flaw was fixed in the May 2018 Patch Tuesday, is listed in CISA KEV with known ransomware use, and public PoCs (0patch, ExploitDB 44741) and exploit kit usage have been documented; EPSS puts its 30-day exploitation probability at 88.5%.

Do: Apply Microsoft's May 2018 security updates (and any later cumulative or Extended Security Updates) to every listed Windows client and server release, as required by the CISA KEV listing, prioritizing internet-reachable and user-facing systems given known ransomware use. Upgrade out-of-support platforms (Windows 7/8.1/RT 8.1, Server 2008/2008 R2, 2012/2012 R2) to supported builds or ensure ESU coverage. As interim mitigation, block VBScript execution in Internet Explorer web zones using Microsoft's documented Group Policy/registry settings, and hunt for prior exploitation on legacy systems.

CVE-2019-0752 is a type confusion (CWE-843) memory corruption vulnerability in the way the scripting engine used by Internet Explorer handles objects in memory, and it is distinct from the related scripting-engine flaws CVE-2019-0739, CVE-2019-0753, and CVE-2019-0862. An attacker triggers it by convincing a user to view attacker-controlled or attacker-crafted web content in Internet Explorer, where malformed handling of in-memory objects corrupts memory (the CVSS vector reflects a network attack requiring user interaction with high attack complexity). Successful exploitation yields remote code execution with the privileges of the current user, giving the attacker high confidentiality, integrity, and availability impact on the host. Anyone running Internet Explorer on supported Windows client or server systems is exposed; the provided data does not specify exact affected version ranges, though the public proof-of-concept was demonstrated on Windows 10 1809 (build 17763.316). Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-15) with known ransomware use, carries a top-percentile EPSS score of 81.6%, and contemporary reporting ties scripting-engine flaws like this to exploit kits (e.g., RIG) delivering malware such as Dridex.

Do: Apply Microsoft's security updates that address CVE-2019-0752 via Windows Update or WSUS, per the CISA KEV required action, and audit legacy Windows clients and servers for any that have not been patched. Where updates are impractical (e.g., out-of-support systems), stop using Internet Explorer as the default browser, restrict or disable scripting in the Internet zone, and consider blocking IE-facing access to untrusted sites. Because exploit kits (e.g., RIG) and ransomware operators have leveraged IE scripting-engine flaws, prioritize patching user workstations and shared/multi-user systems.

CVE-2020-0674 is a use-after-free memory corruption flaw (CWE-416) in the way the Internet Explorer scripting engine handles objects in memory, distinct from a series of sibling scripting-engine RCEs fixed at the same time (CVE-2020-0673, 0710, 0711, 0712, 0713, 0767). Triggering it requires user interaction: an attacker must convince a user to view a specially crafted web page (for example via a phishing link or malicious web content) while it renders in Internet Explorer, and the mishandled memory then allows code execution under the high-complexity, network-reachable conditions reflected in the CVSS vector (AV:N/AC:H/UI:R). Successful exploitation gives the attacker remote code execution with the privileges of the logged-in user, so the practical risk is highest for users browsing with Internet Explorer on Windows, including IE 8 through IE 11 targeted by the public exploits. Exploitation is confirmed in the wild: Microsoft warned of the flaw as an unpatched zero-day being used in targeted attacks before its February 2020 Patch Tuesday fix, public PoC/exploit code is available (including a working exploit for IE 8-11), the Magnitude exploit kit referenced in coverage used it as a delivery vector, and CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03 alongside a very high EPSS score (86.9% probability of exploitation in 30 days, 100th percentile). The required remediation is to apply the Microsoft security updates from February 2020 that address this CVE.

Do: Apply the Microsoft February 2020 Patch Tuesday security updates that fix CVE-2020-0674 on all Windows endpoints and servers, prioritizing per the CISA KEV required action. Until patched, limit Internet Explorer use to trusted sites and consider Microsoft's suggested mitigations (such as restricting active scripting); note that third-party micropatches existed that emulated the vendor workaround without its usability side effects. After patching, verify IE11 remediation status across the estate and, where feasible, retire Internet Explorer usage entirely to reduce exposure to this recurring scripting-engine bug class.

CVE-2021-26411 is a use-after-free (CWE-416) memory corruption vulnerability in Microsoft Internet Explorer's web rendering engine that can lead to remote code execution. It is triggered when a user, typically lured via a link, email, or watering-hole page, views attacker-controlled web content that corrupts memory, consistent with the CVSS profile requiring network access and user interaction. A successful attacker gains code execution in the context of the logged-on user, which in observed campaigns was chained into malware delivery (including exploit-kit payloads such as Dridex and VBA-based malware). Any Windows system that renders web content with Internet Explorer or its IE/MSHTML components (Edge is also listed among affected CPE products) is potentially affected, though specific version ranges are not provided in the source data. The flaw was exploited as a zero-day around Microsoft's March 2021 Patch Tuesday, was added to CISA KEV on 2021-11-03 with known ransomware use, and carries an 80.8% EPSS probability of exploitation within 30 days.

Do: Apply Microsoft's March 2021 cumulative security updates for Internet Explorer, or any later cumulative update, across all Windows clients and servers, prioritizing user workstations per the CISA KEV required action. Review proxy and endpoint logs for visits to compromised watering-hole sites (notably Korean-language news sites) and for follow-on malware such as Dridex, and restrict or disable IE/legacy IE-mode rendering of untrusted web content where feasible.