Skip to navigation

Threat reportMalwareTL-2026-2764

Remcos RAT phishing campaign disguised as project material purchase requests exploits CVE-2017-0199 against Korean companies

highACTIVE

AhnLab ASEC reports phishing emails impersonating employees of a Korean company and posing as project material purchase requests. A malicious XLS attachment exploits CVE-2017-0199 to fetch an HTA file that runs obfuscated PowerShell, pulls a steganographic PNG, extracts a Base64 .NET loader and deploys Remcos RAT.

Key facts

IdentifiersTL-2026-2764, CVE-2017-0199
SeverityHIGH
CVSS7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Exploitation statusLinked CVE exploited in the wild; Listed in CISA KEV: CVE-2017-0199 (added )
EPSSCVE-2017-0199: 99.4% (99.9th percentile)
Affected productsMicrosoft Office; Microsoft Windows (WordPad)
Malware.NET loader (Base64-embedded in PNG), Remcos
ToolsRemcos
MITRE ATT&CK techniquesT1027 Obfuscated Files or Information, T1027.003 Steganography, T1047 Windows Management Instrumentation, T1056.001 Keylogging, T1059.001 PowerShell, T1082 System Information Discovery, T1113 Screen Capture, T1140 Deobfuscate/Decode Files or Information, T1203 Exploitation for Client Execution, T1204.002 Malicious File, T1218.005 Mshta, T1566.001 Spearphishing Attachment and 3 more in the attack flow
MotivationUNKNOWN
Target sectorscorporate, procurement, manufacturing
Target regionssouth korea
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage

As of 2026-09-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2764 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Office Application Spawning Script Host - CVE-2017-0199 Remcos Chain

Detects Excel, Word, WordPad or PowerPoint spawning mshta.exe, PowerShell, WScript/CScript or cmd.exe, the execution hand-off after a malicious XLS exploits CVE-2017-0199 (OLE2Link) to fetch an HTA. Also matches ASEC campaign command-line IOCs (Weprovideforbesthingstocomebackgoodthings.Hta, 172.245.209.133) and the ASEC sample hashes plus the community-observed sibling Remcos SHA256 (9d9f149a...). Office spawning a script host is almost never legitimate on a workstation, so this is the highest-signal exploitation-stage alert.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1566.001, T1204.002, T1203, T1218.005
  • Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
  • Severity: high
  • Confidence: high

Splunk SPL

```CVE-2017-0199 OLE2Link chain - Office/WordPad spawning mshta or script hosts, plus ASEC 2026-09-28 campaign IOCs```
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
(((ParentImage="*EXCEL.EXE" OR ParentImage="*WINWORD.EXE" OR ParentImage="*WORDPAD.EXE" OR ParentImage="*POWERPNT.EXE") (Image="*mshta.exe" OR Image="*powershell.exe" OR Image="*pwsh.exe" OR Image="*wscript.exe" OR Image="*cscript.exe" OR Image="*cmd.exe")) OR CommandLine="*Weprovideforbesthingstocomebackgoodthings*" OR CommandLine="*172.245.209.133*" OR Hashes="*5055c7b0ae1f6f77b16eb744a76cc453*" OR Hashes="*623bc9114d118592170599585e5cf60e*" OR Hashes="*db9ff235eae552276b12622ae9105f1c*" OR Hashes="*9d9f149a0052999587be2078375bb4530b351f3cda1b343c7f81a5d13b02ac45*")
| stats count min(_time) as first_seen values(ParentCommandLine) as parent_cmd values(CommandLine) as cmd by host, User, ParentImage, Image
| convert ctime(first_seen)

Microsoft KQL

// CVE-2017-0199 chain: Office/WordPad spawning mshta or script hosts, plus ASEC campaign IOCs
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (InitiatingProcessFileName in~ ("excel.exe", "winword.exe", "wordpad.exe", "powerpnt.exe") and FileName in~ ("mshta.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "cmd.exe"))
    or ProcessCommandLine has_any ("Weprovideforbesthingstocomebackgoodthings", "172.245.209.133")
    or MD5 in~ ("5055c7b0ae1f6f77b16eb744a76cc453", "623bc9114d118592170599585e5cf60e", "db9ff235eae552276b12622ae9105f1c")
    or SHA256 =~ "9d9f149a0052999587be2078375bb4530b351f3cda1b343c7f81a5d13b02ac45"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, MD5, SHA256

Sigma

title: Office Application Spawning Script Host - CVE-2017-0199 Remcos Chain
id: 3f6a1c52-8b7d-4e21-9a34-5d0c7e8f1a01
status: experimental
description: Detects Excel/Word/WordPad/PowerPoint spawning mshta or script interpreters after CVE-2017-0199 exploitation, or campaign IOCs from the ASEC Remcos purchase-request phishing campaign.
references:
    - https://asec.ahnlab.com/en/95598/
    - https://nvd.nist.gov/vuln/detail/CVE-2017-0199
author: Threadlinqs Team
date: 2026/09/29
tags:
    - attack.initial_access
    - attack.t1566.001
    - attack.execution
    - attack.t1204.002
    - attack.t1203
    - attack.defense_evasion
    - attack.t1218.005
    - attack.s0332
    - cve.2017.0199
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\EXCEL.EXE'
            - '\WINWORD.EXE'
            - '\WORDPAD.EXE'
            - '\POWERPNT.EXE'
    selection_child:
        Image|endswith:
            - '\mshta.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\cmd.exe'
    selection_ioc:
        CommandLine|contains:
            - 'Weprovideforbesthingstocomebackgoodthings'
            - '172.245.209.133'
    selection_hash:
        Hashes|contains:
            - '5055c7b0ae1f6f77b16eb744a76cc453'
            - '623bc9114d118592170599585e5cf60e'
            - 'db9ff235eae552276b12622ae9105f1c'
            - '9d9f149a0052999587be2078375bb4530b351f3cda1b343c7f81a5d13b02ac45'
    condition: (selection_parent and selection_child) or selection_ioc or selection_hash
falsepositives:
    - Office macros or add-ins that legitimately launch cmd.exe or PowerShell (finance or ERP automation)
level: high

Known false positives:

  • Legitimate Office VBA macros or COM add-ins that shell out to cmd.exe or PowerShell (ERP/finance automation)

Tuning notes: Exclude documented internal automation by ParentCommandLine or signed macro path; drop cmd.exe from the child list if noisy. Keep mshta/wscript/cscript/PowerShell children unfiltered. Sysmon Hashes field must include MD5/SHA256 (HashType config).

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • MSHTA Executing Remote HTA From HTTP URL - CVE-2017-0199 Stage · unlock with TL Creds
  • PowerShell Script Block - Steganographic PNG Loader Markers (IN- / -inl) · unlock with TL Creds
  • Remcos Staging Infrastructure Access - HTA, PNG and workers.dev Hosts · unlock with TL Creds
  • Office Application Writing HTA File - CVE-2017-0199 OLE2Link Download · unlock with TL Creds
  • PowerShell Download Of PNG Followed By In-Memory .NET Assembly Load · unlock with TL Creds
  • Remcos RAT Registry Artifact - Software\Remcos-<ID> Key · unlock with TL Creds
  • WMI- or MSHTA-Spawned Obfuscated PowerShell - Remcos HTA Stage · unlock with TL Creds
  • Remcos C2 Beacon - DuckDNS / TCP 19700 From Non-Browser Process · unlock with TL Creds

Indicators of compromise

As of 2026-09-28, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-2764.

Sample indicators (3 of 17)

  • IP address: 172.245.209[.]133
  • Domain: muddy-sound-e0cd[.]nodetectonn[.]workers[.]dev
  • File hash: 5055c7b0ae1f6f77b16eb744a76cc453

Defanged, TLP:CLEAR. Full set of 17 indicators: unlock with TL Creds.

17 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

No threat actor attribution is given.

On 2026-09-28 AhnLab Security Intelligence Center (ASEC) documented a phishing campaign in which emails impersonate employees of a specific company in Korea and present themselves as project material purchase requests. The attached XLS is disguised as a project material purchase request form and shows legitimate-looking purchase content as a decoy to lower the recipient's suspicion.

When the XLS is opened it exploits CVE-2017-0199, an OLE2Link handling flaw in Microsoft Office/WordPad, to download an HTA file from an attacker-hosted server (hxxp://172.245.209.133/70/Weprovideforbesthingstocomebackgoodthings.Hta). The HTA executes obfuscated PowerShell in the background through WMI Win32_Process.Create(). The decoded PowerShell downloads a steganographic PNG from a Cloudflare Workers hosted URL (muddy-sound-e0cd.nodetectonn.workers.dev/HIsPq), locates a Base64-encoded .NET loader embedded in the image using the marker strings "IN-" and "-inl", decodes it and loads it into memory, passing the C2 address as an argument.

The .NET loader then downloads and executes the Remcos RAT payload (served from the same IP as Img_201031.Png). Remcos connects to the dynamic-DNS C2 blessedongrace.duckdns.org on TCP port 19700 and receives and executes remote commands, with keylogging, screen capture, file manipulation and system/user information collection; collected data is sent to the C2.

The technique chain (malicious Excel, CVE-2017-0199, HTA, multi-layer scripting, in-memory Remcos) resembles the fileless Remcos variant Fortinet reported in November 2024 (HTA cookienetbookinetcahce.hta from 192.3.220.22, purchase-order lure), but ASEC does not link the two campaigns or attribute this activity to any actor. ASEC has also published a structurally similar Remcos campaign (Excel lure, CVE-2017-0199, HTA, PowerShell, steganographic PNG, .NET loader) using different infrastructure; no infrastructure overlap with this campaign was identified. CVE-2017-0199 was patched by Microsoft in April 2017 and is listed in the CISA KEV catalog; unpatched Office installations remain exposed. Severity is analyst-assigned; the CVSS score shown is the NVD 3.1 base score for CVE-2017-0199, not for the campaign.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1027.003 Steganography; T1140 Deobfuscate/Decode Files or Information; T1218.005 Mshta; T1620 Reflective Code Loading; T1684.001 Impersonation

Execution

T1047 Windows Management Instrumentation; T1059.001 PowerShell; T1203 Exploitation for Client Execution; T1204.002 Malicious File

Collection

T1056.001 Keylogging; T1113 Screen Capture

Discovery

T1082 System Information Discovery

Initial Access

T1566.001 Spearphishing Attachment

Command and Control

T1568 Dynamic Resolution

Remediation

Patches

  • Apply the Microsoft security update for CVE-2017-0199 (April 2017, see MSRC advisory) on all Office and WordPad installations

Immediate actions

  • Block 172.245.209.133, muddy-sound-e0cd.nodetectonn.workers.dev and blessedongrace.duckdns.org (TCP/19700) at proxy, DNS and firewall
  • Hunt for mshta.exe or powershell.exe spawned by EXCEL.EXE or via WMI Win32_Process.Create, and for the listed MD5 hashes
  • Quarantine XLS attachments in mail that impersonate purchase or procurement requests from internal-looking senders
  • Search proxy logs for requests to /70/Img_201031.Png, /70/Weprovideforbesthingstocomebackgoodthings.Hta and workers.dev /HIsPq

Workarounds

  • Open attachments only in Protected View / Application Guard and block external OLE object linking in Office where the patch cannot be applied

Longer-term hardening

  • Train staff to verify unexpected purchase-request attachments through a second channel
  • Restrict or alert on mshta.exe execution and outbound connections to dynamic-DNS domains
  • Enable EDR behavioral detection for Office spawning script hosts and for in-memory .NET assembly loading

Affected and fixed versions

  • Microsoft — Office
    Vulnerable versions: 2007 SP3; 2010 SP2; 2013 SP1; 2016
    Fixed in: Apply Microsoft update per MSRC advisory for CVE-2017-0199
  • Microsoft — Windows (WordPad)
    Vulnerable versions: Vista SP2; 7 SP1; Server 2008 SP2; Server 2012
    Fixed in: Apply Microsoft update per MSRC advisory for CVE-2017-0199

Timeline

  • Microsoft releases the security update for CVE-2017-0199 in April 2017 Patch Tuesday; the flaw had already been exploited in the wild to deliver malware such as Dridex
  • CVE-2017-0199 (Microsoft Office/WordPad OLE object remote code execution) published in NVD; CVSS 3.1 base score 7.8
  • CISA adds CVE-2017-0199 to the Known Exploited Vulnerabilities catalog
  • CISA KEV remediation due date for CVE-2017-0199 for federal agencies
  • Fortinet FortiGuard reports a purchase-order phishing campaign using malicious Excel and CVE-2017-0199 to deliver a fileless Remcos RAT variant via the HTA cookienetbookinetcahce.hta hosted at 192.3.220.22
  • NVD record for CVE-2017-0199 last modified, listing Office 2007 SP3 to 2016 and Windows Vista SP2 to Server 2012 among affected products
  • AhnLab ASEC publishes analysis of Remcos RAT phishing emails posing as project material purchase requests targeting Korean company employees, with 3 MD5 hashes and C2 indicators

Sources cited

Other reports on CVE-2017-0199

Previous and next in malware

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats