Threat reportThreat IntelligenceTL-2026-4417
Common default passwords used to protect malware-sample archives and encrypted malicious documents (Hexacorn research, incl. Excel VelvetSweatshop)
Common default passwords used to protect malware-sample (TL-2026-4417), also tracked as Malicious archive default passwords, is a low-severity tracked intrusion set, first published 2026-10-24. It has no confirmed attribution, affects Microsoft Microsoft Excel (default VelvetSweatshop decryption key), references 2 CVEs (CVE-2012-0158, CVE-2017-11882), maps to 6 MITRE ATT&CK techniques (T1027, T1027.013, T1140), and is covered by 9 detection rules and 4 indicators of compromise.
- Severity
- LOWAssessed severity
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 4Indicators of compromise
Key facts for TL-2026-4417
- Threat ID
- TL-2026-4417
- Also known as
- Malicious archive default passwords, VelvetSweatshop default Excel key
- Severity
- LOW
- Status
- MONITORING
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, government administration, finance, health
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 4
Malware and tooling in Common default passwords used to protect malware-sample
Malware and tooling: LimeRAT
How Common default passwords used to protect malware-sample works
Hexacorn compiled the passwords most commonly used on malware-sample archives (malware, virus, infected, 1337, 123456, VelvetSweatshop and others) using AI-assisted searching plus manual validation. Knowing these passwords helps defenders triage and unpack password-protected archives, and the VelvetSweatshop entry maps to a documented antivirus-evasion technique used in real Excel malware campaigns.
On 2026-10-24 the Hexacorn blog published part 2 of its 'Solving practical problems with AI' series, listing the passwords most popular for protecting malicious archives. The compiled list includes traditional passwords (malware, virus, infected, inf3cted, pass, god, qwerty, p@ssword), numeric passwords (1337, 123, 1234, 123456, 12345678, 123456789, 111111, 8466) and passwords tied to specific sample-sharing communities or vendors (mysubsarethebest, history, virussign, infected_pcap, infected666, velvet, VelvetSweatshop, S1BinaryVault, shipped, invoice, doc, clean). The post names its sources: the GitHub repository LJ9859/Malware-Database (1337), MalwareWatch (mysubsarethebest), snorrefagerland.github.io/virushistory (history), Kaspersky support documentation (pass), abuse.ch samples (123, 8466), a Reddit SentinelOne XDR discussion (S1BinaryVault) and the virussign.com free list (virussign). The infected666 convention places an extra character before the zip extension. The post describes an iterative AI workflow, starting from a Google search and then asking follow-up questions to widen the candidate list. Its stated conclusion is that the prompts that produced the list matter more than the list itself. The post discusses no malware families, CVEs, IOCs, actors or campaigns.
The list is mostly a research-sharing convention rather than an attack. Two entries still have defensive relevance for adversary tradecraft. 'invoice', 'doc' and 'shipped' are generic words consistent with social-engineering lures. 'VelvetSweatshop' is not a sharing convention. It is the hard-coded default key that Microsoft Excel tries automatically when opening encrypted workbooks, so a file encrypted with it opens without a password prompt. Threatpost (2020-03-31) reported it resurrected in a LimeRAT campaign using read-only encrypted Excel files, and tied the technique to CVE-2012-0158 and to 2012-era use. VMware Carbon Black's Threat Analysis Unit (2020-11-19) documented encrypted samples exploiting CVE-2017-11882 and reported that VelvetSweatshop encryption cut antivirus detection by more than 50%. AES-256-encrypted samples were detected by under 15% of the engines tested, and five products missed the AES-128 and AES-256 variants entirely.
Defender value: SOC and malware-triage teams can use the list as a first-pass wordlist when unpacking quarantined or shared archives. Detection engineers should note that archive passwords are weak signals on their own and need pairing with file-type, delivery-channel and behavioral context. Email and endpoint scanners should attempt known default passwords, VelvetSweatshop in particular, when inspecting Office documents. Severity is LOW and informational: the source describes no active exploitation, but the VelvetSweatshop evasion technique has been exploited in the wild per the cited vendor reports.
MITRE ATT&CK techniques used in TL-2026-4417
Defense Evasion
T1027 Obfuscated Files or Information; T1027.013 Obfuscated Files or Information: Encrypted/Encoded File; T1140 Deobfuscate/Decode Files or Information
Execution
T1203 Exploitation for Client Execution; T1204.002 User Execution: Malicious File
Initial Access
Affected products and versions in Common default passwords used to protect malware-sample
- Microsoft — Microsoft Excel (default VelvetSweatshop decryption key)
Vulnerable versions: Versions that auto-decrypt with the VelvetSweatshop default key
Remediation for Common default passwords used to protect malware-sample
Patches
- Apply Microsoft updates for CVE-2012-0158 and CVE-2017-11882, the Office vulnerabilities cited in VelvetSweatshop-based campaigns
Immediate actions
- Add the Hexacorn password list to the malware-triage and sandbox wordlist for password-protected archives
- Configure email and web gateways to attempt known default passwords, including VelvetSweatshop for Excel, before scanning encrypted attachments
- Quarantine and alert on inbound password-protected archives and encrypted Office documents from external senders
Workarounds
- Block or sandbox encrypted Office documents opened read-only without a password prompt
- Use Protected View and Attack Surface Reduction rules for Office child-process creation
Longer-term hardening
- Deploy detection that unpacks and inspects password-protected content in a sandbox
- Train users that an archive password supplied in the same email as the archive is a phishing indicator
- Pair archive-password heuristics with file-type, sender-reputation and behavioral context, since the passwords are weak signals alone
CVEs associated with Common default passwords used to protect malware-sample
Weaknesses (CWE) in Common default passwords used to protect malware-sample
Timeline of Common default passwords used to protect malware-sample
- Microsoft patched CVE-2012-0158. Threatpost ties the VelvetSweatshop encrypted-Excel evasion technique to this 2012-era vulnerability.
- The VelvetSweatshop default-key technique was presented at the Virus Bulletin conference in 2013 (per Threatpost; exact day not stated, month approximated to the conference year).
- Microsoft patched CVE-2017-11882 (Equation Editor memory corruption), later exploited in VelvetSweatshop-encrypted Excel samples analyzed by VMware.
- Threatpost reported the VelvetSweatshop default-key technique resurrected in a LimeRAT delivery campaign using read-only encrypted Excel files.
- VMware NSX detected VelvetSweatshop-encrypted malicious Excel samples exploiting CVE-2017-11882 delivered by phishing email.
- VMware ran its VirusTotal detection-rate analysis: encrypted samples were detected 55-60%, AES-128 variants 15-30% and AES-256 variants under 15%.
- VMware Threat Analysis Unit published findings that VelvetSweatshop encryption cut antivirus detection by more than 50% for CVE-2017-11882 samples.
- Hexacorn published part 2 of its AI-assisted series compiling the most common passwords for malicious archives, including VelvetSweatshop, infected and 1337.
Sources cited for Common default passwords used to protect malware-sample
- Solving practical problems with AI, part 2: the most popular and most commonly used passwords for malicious archives
- 8-Year-Old VelvetSweatshop Bug Resurrected in LimeRAT Campaign (Threatpost)
- VelvetSweatshop: When default passwords can still make a difference (VMware Security Blog)
- Attackers Leverage Excel File Encryption to Deliver Malware (Dark Reading)
- VelvetSweatshop: Microsoft Excel spreadsheet encryption rises again to deliver LimeRAT (Mimecast)
- Excel Malspam: Password Protected, Not! (LevelBlue SpiderLabs)
- NVD: CVE-2012-0158
- NVD: CVE-2017-11882
Detection coverage for TL-2026-4417
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4417 across Splunk SPL, Microsoft KQL and Sigma, covering 4 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.