Patchwork hacker crew is spying on companies in multiple industries

CVE-2012-0158 is a remote code execution flaw in Microsoft's MSCOMCTL.OCX, the Windows Common Controls ActiveX component, where improper handling of crafted input allows memory corruption and code execution. It is typically triggered when an application that uses the control (most commonly Microsoft Office) processes specially crafted content, such as a malicious document or file, meaning a victim usually has to open attacker-supplied content. Successful exploitation lets an attacker run arbitrary code and take complete control of the affected system with the privileges of the current user. Any Windows system carrying a vulnerable copy of MSCOMCTL.OCX — including systems where the control was redistributed by legacy applications — is affected, which makes the potential population very large. Exploitation is confirmed and ongoing: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, and EPSS assigns it the maximum reported probability of exploitation within 30 days.

Do: Apply the Microsoft security update for MSCOMCTL.OCX (per vendor instructions, per CISA's required action) on all systems, prioritizing endpoints and servers that open Office documents. Because exploitation commonly arrives via malicious documents, treat unsolicited Office/RTF attachments with suspicion and verify that applications that redistribute MSCOMCTL.OCX have installed a patched copy. Scan the estate for the presence and version of MSCOMCTL.OCX, especially on legacy Windows/Office installations that may be missed by routine patching.

CVE-2014-4114 is a flaw in the Windows Object Linking & Embedding (OLE) component, categorized as improper input validation (CWE-20), that permits remote code execution when a user opens a file containing a specially crafted OLE object. It is triggered entirely through user interaction — opening a malicious document such as an Office/PowerPoint file with an embedded OLE object — with no prior authentication or network service exposed. A successful attacker gains code execution in the context of the logged-on user, enabling follow-on actions such as downloading payloads or moving laterally within an enterprise. All affected Windows releases are exposed; Microsoft addressed the flaw in its November 2014 security updates. Exploitation was observed in the wild by the Sandworm threat group using weaponized PowerPoint files, and the flaw carries a very high likelihood of exploitation (EPSS 81.6%, 100th percentile) and was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-03.

Do: Apply Microsoft's Windows OLE security update from the November 2014 release to all affected Windows hosts, per the CISA KEV required action; the CVSS score is not yet published, so treat this as high priority given the RCE impact. As interim mitigation, limit opening of untrusted Office files containing embedded OLE objects and consider restricting OLE object activation for files from the internet zone. For detection, check endpoints for suspicious outbound SMB connections initiated shortly after a user opens a PowerPoint/Office document, a pattern associated with Sandworm exploitation of this flaw.

Microsoft Office contains a memory corruption flaw (CWE-399) in its handling of Rich Text Format (RTF) files, allowing a crafted RTF document to corrupt memory when the file is parsed. The flaw is triggered by opening a specially crafted RTF file — typically delivered as an email attachment — in an affected version of Microsoft Office. Successful exploitation yields remote code execution in the context of the current user, so attacker privilege is limited to the rights of the logged-in account. Per the CISA data, Microsoft Office is the affected product, with no specific version ranges provided; the flaw was fixed in Microsoft's April 2015 Patch Tuesday security updates (MS15-033), so risk is concentrated on systems that never applied those updates. Exploitation is confirmed in the wild — the CVE was added to the CISA KEV on 2021-11-03 (ransomware use unknown) — it carries a 96.8% EPSS probability of exploitation within 30 days (100th percentile), and related reporting links RTF exploit techniques of this era to targeted APT campaigns (e.g., the T9000 backdoor and DragonOK tooling).

Do: Apply Microsoft's April 2015 Office security updates (MS15-033) on all endpoints, per the CISA KEV required action, prioritizing hosts running older Office editions, and verify installation via installed-updates checks. As interim hardening, treat inbound RTF files with suspicion (block or sandbox RTF email attachments) and monitor for suspicious child processes spawned by Word (e.g., Winword.exe launching cmd.exe or PowerShell) to detect possible prior exploitation. Organizations still on legacy Office versions should upgrade to currently supported editions that receive ongoing security updates.