Operation Wilted Tulip

clearskysec.com · Undated · Licence: not cleared; local research copy only

CVEs this report names

1 CVE

CVE-2017-0199Microsoft Office and WordPad Remote Code Execution Vulnerability
Microsoft · Office and WordPadKEVRansomwarePublic exploitHigh · 7.8T1204.002Malicious File T1203Exploitation for Client Execution12 reports
99.5%Top 0.06%
88.4priority

Exploiting CVE-2017-0199 ............................................................................................................................

The attackers use three document based exploitation types: exploiting CVE-2017-0199, embedding OLE

Exploiting CVE-2017-0199

The document exploited CVE-2017-0199, downloading an rtf file from:

None

No passage in this report has been tied to an ATT&CK technique.