Exploit kits remain active in April 2021: RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude targeting Internet Explorer (CVE-2020-0674, CVE-2021-26411, CVE-2018-8174, CVE-2018-15982, CVE-2020-1380)

Key facts for IE exploit kit drive-bys

Detection coverage for IE exploit kit drive-bys

As of 2026-11-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5496 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Exploit Kit Drive-By: Internet Explorer / EdgeHTML Spawning Script Hosts or LOLBins (CVE-2021-26411, CVE-2020-0674, CVE-2020-1380, CVE-2018-8174)

TL-2026-5496 (RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude). Detects a browser process (iexplore.exe or the EdgeHTML content process MicrosoftEdgeCP.exe) creating a script host, shell or download-capable LOLBin child. This is the post-exploitation signature of a successful MSHTML/JScript/VBScript memory-corruption drive-by (CVE-2021-26411, CVE-2020-0674, CVE-2020-1380, CVE-2018-8174). Legitimate browsing does not normally launch wscript, cscript, powershell, mshta, msiexec or regsvr32 from the browser process.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1203, T1059.005, T1059.001
• Data sources: sysmon, windows_security
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (ParentImage="*iexplore.exe" OR ParentImage="*MicrosoftEdgeCP.exe") (Image="*wscript.exe" OR Image="*cscript.exe" OR Image="*powershell.exe" OR Image="*pwsh.exe" OR Image="*cmd.exe" OR Image="*mshta.exe" OR Image="*msiexec.exe" OR Image="*regsvr32.exe" OR Image="*rundll32.exe" OR Image="*certutil.exe" OR Image="*bitsadmin.exe")
| eval cve_context="CVE-2021-26411 CVE-2020-0674 CVE-2020-1380 CVE-2018-8174 exploit-kit drive-by"
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as child_images values(CommandLine) as child_cmdlines by host, user, ParentImage, cve_context
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ('iexplore.exe', 'MicrosoftEdgeCP.exe')
| where FileName in~ ('wscript.exe', 'cscript.exe', 'powershell.exe', 'pwsh.exe', 'cmd.exe', 'mshta.exe', 'msiexec.exe', 'regsvr32.exe', 'rundll32.exe', 'certutil.exe', 'bitsadmin.exe')
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256

Sigma

title: Browser Exploit Kit Drive-By - IE/EdgeHTML Spawning Script Host or LOLBin
id: 3f8b2c1e-6a4d-4e07-9b53-1d2c7e5a9f01
status: experimental
description: Detects Internet Explorer or the EdgeHTML content process launching a script host, shell or download-capable LOLBin, the post-exploitation signature of exploit-kit drive-by compromise (RIG, PurpleFox, Bottle, Magnitude, Spelevo) via CVE-2021-26411, CVE-2020-0674, CVE-2020-1380 and CVE-2018-8174.
references:
  - http://nao-sec.org/2021/04/exploit-kit-still-sharpens-a-sword.html
  - https://threatresearch.ext.hp.com/purple-fox-exploit-kit-now-exploits-cve-2021-26411/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/07
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059.005
  - attack.t1059.001
  - cve.2021.26411
  - cve.2020.0674
  - cve.2020.1380
  - cve.2018.8174
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\iexplore.exe'
      - '\MicrosoftEdgeCP.exe'
  selection_child:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\mshta.exe'
      - '\msiexec.exe'
      - '\regsvr32.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legacy intranet applications running in IE Enterprise Mode that launch helper executables
  - ActiveX or add-on installers that invoke msiexec from the browser
level: high

Known false positives:

• Legacy intranet applications in IE Enterprise Mode that launch helper executables (cmd, wscript) from the browser
• ActiveX or browser add-on installers that legitimately invoke msiexec.exe or rundll32.exe

Tuning notes: Allowlist known line-of-business apps by CommandLine or user group, and scope to hosts that still run iexplore.exe. Raise priority when the child process has an internet URL in its command line or the host is not in the IE Enterprise Mode inventory.

• 🔒 Flash Player Exploit Child Process (CVE-2018-15982) - Underminer and Spelevo · unlock with TL Creds
• 🔒 Cinobi DLL Sideloading Artifacts: [indicator], [indicator] and Known Exploit Kit Payload Hashes · unlock with TL Creds
• 🔒 Cinobi Tor C2 and Malvertising Network Activity via Defender Network Events · unlock with TL Creds
• 🔒 Cinobi Malvertising Domain DNS Resolution (Bottle Exploit Kit) · unlock with TL Creds
• 🔒 Purple Fox Rootkit Driver and DLL Naming Pattern (_dump_*.sys, _Ms*App.dll) · unlock with TL Creds
• 🔒 Network Connection to Underminer Exploit Kit IP or Cinobi Tor C2 · unlock with TL Creds
• 🔒 Purple Fox Post-Exploitation: msiexec Remote Install and Image-Disguised PowerShell Payload · unlock with TL Creds
• 🔒 Exploit Kit Infrastructure Contact: Underminer IP, Cinobi Malvertising and Tor C2 Domains, Community Sibling Domains · unlock with TL Creds

Indicators of compromise for IE exploit kit drive-bys

As of 2026-11-07, Threadlinqs Intelligence tracks 25 indicators of compromise for TL-2026-5496.

Sample indicators (3 of 25)

• IP address: 98.126.222[.]187
• Domain: www[.]chirigame[.]com
• File hash: 124FE26D53E2702B42AE07F8AEC5EE4E79E7424BCE6ECDA608536BBF0A7A2377

Defanged, TLP:CLEAR. Full set of 25 indicators: unlock with TL Creds.

How IE exploit kit drive-bys works

In its April 2021 article "Exploit Kit still sharpens a sword", nao_sec (using its Augma System, a three-year observation environment) tabulated the exploit kits it could still observe. RIG (active since 2014, public, still updated) used CVE-2020-0674 and CVE-2021-26411; its landing pages were noted as no longer as obfuscated as they used to be and its payloads are RC4 encrypted. Spelevo (emerged 2019, public, not updated) used CVE-2018-8174 and CVE-2018-15982 and hides the malware in an image. PurpleFox (private, updated) was fast at adding new vulnerabilities and used CVE-2021-26411. Underminer (private, not updated, extremely difficult to analyze, with cycles of activity and dormancy) used CVE-2018-15982 and delivers Hidden Bee. Bottle (private, updated) targets Japan, was revived in April 2021, used CVE-2020-1380 and CVE-2021-26411, and delivers Cinobi. Magnitude (private, updated) used CVE-2021-26411 and was observed in Korea and Taiwan.

Supporting research gives more detail. HP Threat Research documented Purple Fox adding a CVE-2021-26411 exploit in March 2021, very similar to a public PoC released by Enki in mid-March 2021. Trend Micro's 2019 analysis of Purple Fox delivered by RIG described a fileless PowerShell chain disguised as a .jpg, privilege escalation via CVE-2015-1701 and CVE-2018-8120, msiexec-based download of the main component, DLL injection into a suspended svchost process, and a rootkit hiding a driver and DLL. Malwarebytes documented Underminer's client-server key-exchange encryption of IE exploits (defeating traffic replay), a Flash exploit with a randomized _getSalt() routine, and the non-PE modular Hidden Bee payload. Cisco Talos documented Spelevo delivering IcedID and Dridex. Trend Micro (August 2021) tied Bottle and the Cinobi banking trojan to a group it tracks as Water Kappa; Cinobi targeted users of 11 Japanese financial institutions (three cryptocurrency exchanges), was delivered through malvertising and ZIP archives sideloading a DLL via a legitimate Logitech Capture executable, filtered non-Japanese IPs via Cloudflare, and used Tor C&C. Bottle activity decreased in mid-June 2021.

The nao_sec article states no attribution, CVSS or IOCs; the severity is an analyst assessment and the CVSS shown is the NVD score of CVE-2021-26411, the CVE shared by RIG, PurpleFox, Bottle and Magnitude. Users who run Internet Explorer or EdgeHTML-based Edge, or legacy Adobe Flash Player, on unpatched Windows are exposed to drive-by compromise from malvertising or compromised sites.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1014 Rootkit; T1027 Obfuscated Files or Information; T1027.003 Steganography; T1055.001 Dynamic-link Library Injection; T1218.007 Msiexec; T1480 Execution Guardrails

Credential Access

T1056 Input Capture

Execution

T1059.001 PowerShell; T1059.005 Visual Basic; T1203 Exploitation for Client Execution

Command and Control

T1090.003 Multi-hop Proxy

stealth

T1574.001 DLL

Resource Development

T1583.008 Malvertising

Remediation for IE exploit kit drive-bys

Patches

• CVE-2021-26411: Microsoft March 2021 security updates
• CVE-2020-0674: Microsoft February 2020 security updates
• CVE-2020-1380: Microsoft August 2020 security updates
• CVE-2018-8174: Microsoft May 2018 security updates
• CVE-2018-15982: Adobe Flash Player security update (APSB18-44) or uninstall Flash

Immediate actions

• Apply the Microsoft cumulative updates fixing CVE-2020-0674, CVE-2020-1380, CVE-2018-8174 and CVE-2021-26411 on all Windows hosts
• Remove or disable Adobe Flash Player (CVE-2018-15982 affects Flash 31.0.0.153 and earlier)
• Block the network and file IOCs listed in this record at proxy, DNS and EDR
• Hunt for Internet Explorer (iexplore.exe) spawning script hosts, PowerShell, msiexec.exe or unsigned DLL loads

Workarounds

• Disable or restrict scripting engines in Internet Explorer for the Internet zone
• Block access to Internet Explorer for web browsing via application control

Longer-term hardening

• Retire Internet Explorer and move users to a supported browser with Enterprise Mode only where unavoidable
• Deploy EDR with behavioral detection for browser exploitation and DLL sideloading
• Filter malvertising with DNS and web-proxy category controls
• Restrict script engines (jscript.dll, vbscript.dll) in the Internet zone via registry/GPO

Affected and fixed versions

• Microsoft — Internet Explorer 9/10/11 and EdgeHTML-based Microsoft Edge
  Vulnerable versions: Internet Explorer 9; Internet Explorer 10; Internet Explorer 11; EdgeHTML Edge (CVE-2021-26411)
  Fixed in: Microsoft security updates for CVE-2020-0674, CVE-2020-1380, CVE-2021-26411
• Microsoft — Windows 7, 8.1, 10 and Windows Server 2008 R2-2019 (VBScript engine, CVE-2018-8174)
  Vulnerable versions: Windows 7 SP1; Windows 8.1; Windows 10; Windows Server 2008 R2 through 2019
  Fixed in: May 2018 security updates (CVE-2018-8174)
• Adobe — Flash Player
  Vulnerable versions: 31.0.0.153 and earlier (CVE-2018-15982)
  Fixed in: Later than 31.0.0.153 / APSB18-44; product is end-of-life

Timeline of IE exploit kit drive-bys

• 2018-05-09 CVE-2018-8174 (IE VBScript engine RCE) published; later used by Spelevo and earlier by Underminer and RIG
• 2018-12-15 Malwarebytes observes Underminer updated in mid-December 2018 with the CVE-2018-15982 Flash exploit and client-server key-exchange encryption delivering locked-ioc-20
• 2019-01-18 CVE-2018-15982 (Flash Player use-after-free) published in NVD
• 2019-09-09 Trend Micro publishes analysis of Purple Fox delivered by locked-ioc-18 with fileless PowerShell and rootkit components
• 2020-02-11 CVE-2020-0674 (IE scripting engine use-after-free) published; later used by RIG
• 2020-08-17 CVE-2020-1380 (IE scripting engine memory corruption) published; later used by Bottle EK
• 2021-03-11 CVE-2021-26411 (IE memory corruption) published and patched by Microsoft
• 2021-03-15 Public PoC for CVE-2021-26411 released by Enki in mid-March 2021; HP reports Purple Fox soon added a very similar exploit
• 2021-04-15 nao_sec publishes 'Exploit Kit still sharpens a sword' showing RIG, Spelevo, locked-ioc-21, Underminer, Bottle and Magnitude still active; Bottle revived in April 2021
• 2021-08-09 Trend Micro reports Bottle EK/locked-ioc-23 campaign by Water Kappa targeting Japanese cryptocurrency exchange users; Bottle traffic declined by mid-June 2021

Sources cited for IE exploit kit drive-bys

• NVD CVE-2021-26411 NVD (NIST) · Advisory · 2021-03-11
• NVD CVE-2020-0674 NVD (NIST) · Advisory · 2020-02-11
• NVD CVE-2020-1380 NVD (NIST) · Advisory · 2020-08-17
• NVD CVE-2018-8174 NVD (NIST) · Advisory · 2018-05-09
• NVD CVE-2018-15982 NVD (NIST) · Advisory · 2019-01-18
• From PoC to Exploit Kit: Purple Fox now exploits CVE-2021-26411 (HP Threat Research) threatresearch.ext.hp.com · Vendor report
• Cinobi Banking Trojan Targets Users of Cryptocurrency Exchanges (Trend Micro) Trend Micro · Vendor report · 2021-08-09
• Underminer exploit kit improves in its latest iteration (Malwarebytes) malwarebytes.com · Vendor report
• Spelevo exploit kit (Cisco Talos) Cisco Talos · Vendor report
• Purple Fox fileless malware with rootkit component delivered by RIG exploit kit now abuses PowerShell (Trend Micro) Trend Micro · Vendor report · 2019-09-09
• CVE-2021-26411: Internet Explorer MSHTML Double-Free (Project Zero 0-days in the wild RCA) googleprojectzero.github.io · Research
• Exploit Kit still sharpens a sword (nao_sec) nao-sec.org · Blog · 2021-04-15

More in malware

• YobaLoader Campaign: DLL Sideloading in Signed OpenAI/Anthropic-Themed Binaries via Fake GitHub Repositories Delivering XMRig
• Radio Exploit Kit drive-by download campaign exploiting CVE-2016-0189 to deliver AZORult
• Bottle Exploit Kit (BottleEK) - Malvertising Campaign Targeting Japanese Users via CVE-2018-8174 and CVE-2018-15982
• Fake Security Tools on GitHub Deliver AsyncRAT, Clipper and Infostealer via Trojan.Loader.3261 Electron Loader (Microsoft.exe)
• GhostBat Android Banking Malware Targets 60 Banking and Payment Apps in India