# Exploit kits remain active in April 2021: RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude targeting Internet Explorer (CVE-2020-0674, CVE-2021-26411, CVE-2018-8174, CVE-2018-15982, CVE-2020-1380)

> nao_sec reported in April 2021 that six exploit kits (RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude) were still observable in the wild, delivering drive-by downloads mainly against Internet Explorer. Exploited flaws include CVE-2020-0674, CVE-2021-26411, CVE-2018-8174, CVE-2018-15982 and CVE-2020-1380; delivered payloads include PurpleFox, Hidden Bee (Underminer) and Cinobi (Bottle).

- **Published:** 2026-11-07T08:00:53Z
- **Last reviewed:** 2026-11-07T08:00:53Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5496
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5496.png
- **ID:** TL-2026-5496
- **Severity:** HIGH (CVSS 8.8)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 25 (3 shown free below)
- **CVEs:** CVE-2020-0674, CVE-2021-26411, CVE-2018-8174, CVE-2018-15982, CVE-2020-1380

## Description

In its April 2021 article "Exploit Kit still sharpens a sword", nao_sec (using its Augma System, a three-year observation environment) tabulated the exploit kits it could still observe. RIG (active since 2014, public, still updated) used CVE-2020-0674 and CVE-2021-26411; its landing pages were noted as no longer as obfuscated as they used to be and its payloads are RC4 encrypted. Spelevo (emerged 2019, public, not updated) used CVE-2018-8174 and CVE-2018-15982 and hides the malware in an image. PurpleFox (private, updated) was fast at adding new vulnerabilities and used CVE-2021-26411. Underminer (private, not updated, extremely difficult to analyze, with cycles of activity and dormancy) used CVE-2018-15982 and delivers Hidden Bee. Bottle (private, updated) targets Japan, was revived in April 2021, used CVE-2020-1380 and CVE-2021-26411, and delivers Cinobi. Magnitude (private, updated) used CVE-2021-26411 and was observed in Korea and Taiwan.

Supporting research gives more detail. HP Threat Research documented Purple Fox adding a CVE-2021-26411 exploit in March 2021, very similar to a public PoC released by Enki in mid-March 2021. Trend Micro's 2019 analysis of Purple Fox delivered by RIG described a fileless PowerShell chain disguised as a .jpg, privilege escalation via CVE-2015-1701 and CVE-2018-8120, msiexec-based download of the main component, DLL injection into a suspended svchost process, and a rootkit hiding a driver and DLL. Malwarebytes documented Underminer's client-server key-exchange encryption of IE exploits (defeating traffic replay), a Flash exploit with a randomized _getSalt() routine, and the non-PE modular Hidden Bee payload. Cisco Talos documented Spelevo delivering IcedID and Dridex. Trend Micro (August 2021) tied Bottle and the Cinobi banking trojan to a group it tracks as Water Kappa; Cinobi targeted users of 11 Japanese financial institutions (three cryptocurrency exchanges), was delivered through malvertising and ZIP archives sideloading a DLL via a legitimate Logitech Capture executable, filtered non-Japanese IPs via Cloudflare, and used Tor C&C. Bottle activity decreased in mid-June 2021.

The nao_sec article states no attribution, CVSS or IOCs; the severity is an analyst assessment and the CVSS shown is the NVD score of CVE-2021-26411, the CVE shared by RIG, PurpleFox, Bottle and Magnitude. Users who run Internet Explorer or EdgeHTML-based Edge, or legacy Adobe Flash Player, on unpatched Windows are exposed to drive-by compromise from malvertising or compromised sites.

## MITRE ATT&CK

- T1583.008 Malvertising
- T1203 Exploitation for Client Execution
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1574.001 DLL
- T1027 Obfuscated Files or Information
- T1027.003 Steganography
- T1014 Rootkit
- T1055.001 Dynamic-link Library Injection
- T1218.007 Msiexec
- T1480 Execution Guardrails
- T1056 Input Capture
- T1090.003 Multi-hop Proxy

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Exploit Kit Drive-By: Internet Explorer / EdgeHTML Spawning Script Hosts or LOLBins (CVE-2021-26411, CVE-2020-0674, CVE-2020-1380, CVE-2018-8174)** (`TL-2026-5496-SPL-001`)

TL-2026-5496 (RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude). Detects a browser process (iexplore.exe or the EdgeHTML content process MicrosoftEdgeCP.exe) creating a script host, shell or download-capable LOLBin child. This is the post-exploitation signature of a successful MSHTML/JScript/VBScript memory-corruption drive-by (CVE-2021-26411, CVE-2020-0674, CVE-2020-1380, CVE-2018-8174). Legitimate browsing does not normally launch wscript, cscript, powershell, mshta, msiexec or regsvr32 from the browser process.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1203, T1059.005, T1059.001
- **Data sources:** sysmon, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (ParentImage="*iexplore.exe" OR ParentImage="*MicrosoftEdgeCP.exe") (Image="*wscript.exe" OR Image="*cscript.exe" OR Image="*powershell.exe" OR Image="*pwsh.exe" OR Image="*cmd.exe" OR Image="*mshta.exe" OR Image="*msiexec.exe" OR Image="*regsvr32.exe" OR Image="*rundll32.exe" OR Image="*certutil.exe" OR Image="*bitsadmin.exe")
| eval cve_context="CVE-2021-26411 CVE-2020-0674 CVE-2020-1380 CVE-2018-8174 exploit-kit drive-by"
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as child_images values(CommandLine) as child_cmdlines by host, user, ParentImage, cve_context
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ('iexplore.exe', 'MicrosoftEdgeCP.exe')
| where FileName in~ ('wscript.exe', 'cscript.exe', 'powershell.exe', 'pwsh.exe', 'cmd.exe', 'mshta.exe', 'msiexec.exe', 'regsvr32.exe', 'rundll32.exe', 'certutil.exe', 'bitsadmin.exe')
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
```

### Sigma

```yaml
title: Browser Exploit Kit Drive-By - IE/EdgeHTML Spawning Script Host or LOLBin
id: 3f8b2c1e-6a4d-4e07-9b53-1d2c7e5a9f01
status: experimental
description: Detects Internet Explorer or the EdgeHTML content process launching a script host, shell or download-capable LOLBin, the post-exploitation signature of exploit-kit drive-by compromise (RIG, PurpleFox, Bottle, Magnitude, Spelevo) via CVE-2021-26411, CVE-2020-0674, CVE-2020-1380 and CVE-2018-8174.
references:
  - http://nao-sec.org/2021/04/exploit-kit-still-sharpens-a-sword.html
  - https://threatresearch.ext.hp.com/purple-fox-exploit-kit-now-exploits-cve-2021-26411/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/07
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059.005
  - attack.t1059.001
  - cve.2021.26411
  - cve.2020.0674
  - cve.2020.1380
  - cve.2018.8174
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\iexplore.exe'
      - '\MicrosoftEdgeCP.exe'
  selection_child:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\mshta.exe'
      - '\msiexec.exe'
      - '\regsvr32.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legacy intranet applications running in IE Enterprise Mode that launch helper executables
  - ActiveX or add-on installers that invoke msiexec from the browser
level: high
```

**Known false positives:**

- Legacy intranet applications in IE Enterprise Mode that launch helper executables (cmd, wscript) from the browser
- ActiveX or browser add-on installers that legitimately invoke msiexec.exe or rundll32.exe

**Tuning notes:** Allowlist known line-of-business apps by CommandLine or user group, and scope to hosts that still run iexplore.exe. Raise priority when the child process has an internet URL in its command line or the host is not in the IE Enterprise Mode inventory.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Flash Player Exploit Child Process (CVE-2018-15982) - Underminer and Spelevo (locked: unlock with TL Creds)
- Cinobi DLL Sideloading Artifacts: [indicator], [indicator] and Known Exploit Kit Payload Hashes (locked: unlock with TL Creds)
- Cinobi Tor C2 and Malvertising Network Activity via Defender Network Events (locked: unlock with TL Creds)
- Cinobi Malvertising Domain DNS Resolution (Bottle Exploit Kit) (locked: unlock with TL Creds)
- Purple Fox Rootkit Driver and DLL Naming Pattern (_dump_*.sys, _Ms*App.dll) (locked: unlock with TL Creds)
- Network Connection to Underminer Exploit Kit IP or Cinobi Tor C2 (locked: unlock with TL Creds)
- Purple Fox Post-Exploitation: msiexec Remote Install and Image-Disguised PowerShell Payload (locked: unlock with TL Creds)
- Exploit Kit Infrastructure Contact: Underminer IP, Cinobi Malvertising and Tor C2 Domains, Community Sibling Domains (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 25)

Defanged, TLP:CLEAR.

- IP address: `98.126.222[.]187`
- Domain: `www[.]chirigame[.]com`
- File hash: `124FE26D53E2702B42AE07F8AEC5EE4E79E7424BCE6ECDA608536BBF0A7A2377`

Full set of 25 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Exploit Kit still sharpens a sword (nao_sec)](http://nao-sec.org/2021/04/exploit-kit-still-sharpens-a-sword.html)
- [From PoC to Exploit Kit: Purple Fox now exploits CVE-2021-26411 (HP Threat Research)](https://threatresearch.ext.hp.com/purple-fox-exploit-kit-now-exploits-cve-2021-26411/)
- [Cinobi Banking Trojan Targets Users of Cryptocurrency Exchanges (Trend Micro)](https://www.trendmicro.com/en_us/research/21/h/cinobi-banking-trojan-targets-users-of-cryptocurrency-exchanges-.html)
- [Underminer exploit kit improves in its latest iteration (Malwarebytes)](https://www.malwarebytes.com/blog/threat-analysis/2018/12/underminer-exploit-kit-improves-latest-iteration/)
- [Spelevo exploit kit (Cisco Talos)](https://blog.talosintelligence.com/spelevo-exploit-kit/)
- [Purple Fox fileless malware with rootkit component delivered by RIG exploit kit now abuses PowerShell (Trend Micro)](https://www.trendmicro.com/en_us/research/19/i/purple-fox-fileless-malware-with-rookit-component-delivered-by-rig-exploit-kit-now-abuses-powershell.html)
- [NVD CVE-2021-26411](https://nvd.nist.gov/vuln/detail/CVE-2021-26411)
- [NVD CVE-2020-0674](https://nvd.nist.gov/vuln/detail/CVE-2020-0674)
- [NVD CVE-2020-1380](https://nvd.nist.gov/vuln/detail/CVE-2020-1380)
- [NVD CVE-2018-8174](https://nvd.nist.gov/vuln/detail/CVE-2018-8174)
- [NVD CVE-2018-15982](https://nvd.nist.gov/vuln/detail/CVE-2018-15982)
- [CVE-2021-26411: Internet Explorer MSHTML Double-Free (Project Zero 0-days in the wild RCA)](https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2021/CVE-2021-26411.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5496