Threat reportMalwareTL-2026-5498
Bottle Exploit Kit (BottleEK) - Malvertising Campaign Targeting Japanese Users via CVE-2018-8174 and CVE-2018-15982
Bottle EK is a Japan-only exploit kit spread through malvertising. It exploits Internet Explorer (CVE-2018-8174) and Adobe Flash Player (CVE-2018-15982) and only fires when the browser language contains "ja" and the user-agent is Internet Explorer. Its payload is a stealer that fetches Tor and communicates with onion C2 servers; from 2019-09-29 Trend Micro saw it deliver the Cinobi banking trojan as part of Operation Overtrap. First disclosed .
Key facts for Bottle EK exploit kit
Detection coverage for Bottle EK exploit kit
As of 2026-11-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5498 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: BottleEK Exploitation — Internet Explorer Spawning Masqueraded svchost.exe (CVE-2018-8174 / CVE-2018-15982)
Detects the BottleEK (TL-2026-5498) post-exploit shellcode stage: after the CVE-2018-8174 VBScript or CVE-2018-15982 Flash use-after-free fires inside Internet Explorer, the Shikata Ga Nai shellcode saves the stealer as svchost.exe in %TEMP% and launches it via WinExec. The real svchost.exe is always started by services.exe from System32/SysWOW64 and is never a child of iexplore.exe, so any iexplore.exe -> svchost.exe process outside the system directories is a high-fidelity drive-by exploitation signal.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1203, T1036.005, T1189
- Data sources: sysmon, index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1, DeviceProcessEvents
- Severity: critical
- Confidence: high
Splunk SPL
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
ParentImage="*\\iexplore.exe" Image="*\\svchost.exe"
```BottleEK shellcode drops the stealer as svchost.exe in the user temp dir; legitimate svchost lives only in System32 or SysWOW64```
| where NOT match(lower(Image),"^c:\\\\windows\\\\(system32|syswow64)\\\\svchost\\.exe$")
| eval staging_dir=case(match(lower(Image),"\\\\temp\\\\"),"temp", match(lower(Image),"\\\\users\\\\public\\\\"),"public", match(lower(Image),"\\\\locallow\\\\"),"locallow", true(),"other")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as cmdlines values(Hashes) as hashes by host User ParentImage Image staging_dir
| convert ctime(first_seen) ctime(last_seen)Microsoft KQL
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "iexplore.exe"
| where FileName =~ "svchost.exe"
// legitimate svchost only runs from the system directories
| where FolderPath !in~ (@"c:\windows\system32\svchost.exe", @"c:\windows\syswow64\svchost.exe")
| extend StagingDir = case(FolderPath contains @"\temp\", "temp", FolderPath contains @"\users\public\", "public", FolderPath contains @"\locallow\", "locallow", "other")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, ProcessCommandLine, SHA256, StagingDirSigma
title: BottleEK Internet Explorer Spawning Masqueraded svchost.exe
id: 3f6a1c52-8d4e-4b27-9a61-5c0e7d2b94a1
status: experimental
description: Detects Internet Explorer spawning an svchost.exe outside System32/SysWOW64, the BottleEK shellcode stage that follows CVE-2018-8174 or CVE-2018-15982 exploitation (TL-2026-5498).
references:
- http://nao-sec.org/2019/12/say-hello-to-bottle-exploit-kit.html
- https://www.trendmicro.com/en_us/research/20/c/operation-overtrap-targets-japanese-online-banking-users-via-bot.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/07
tags:
- attack.execution
- attack.t1203
- attack.defense_evasion
- attack.t1036.005
- attack.initial_access
- attack.t1189
- cve.2018-8174
- cve.2018-15982
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: '\iexplore.exe'
Image|endswith: '\svchost.exe'
filter_system:
Image|startswith:
- 'C:\Windows\System32\'
- 'C:\Windows\SysWOW64\'
condition: selection and not filter_system
falsepositives:
- Unlikely; no legitimate workflow starts svchost.exe from Internet Explorer
- Custom software that installs a service-host copy from a browser download (very rare)
level: high
Known false positives:
- Software-installer test harnesses that copy a renamed service host from a browser session
- Security-lab or red-team simulations of drive-by delivery
Tuning notes: Requires Sysmon EventCode 1 with ParentImage. Change index=sysmon to match your Sysmon index. If IE is fully retired in your estate, extend ParentImage to other legacy browser hosts and raise alert priority. Exclude documented lab hosts by host name.
- BottleEK Exploitation — Endpoint Connections to BottleEK Landing/Exploit Infrastructure (inteleksys.com) · unlock with TL Creds
- Cinobi Post-Exploitation — Windows Update and Security Health Services Disabled (UsoSvc, wuauserv, WaaSMedicSvc, SecurityHealthService) · unlock with TL Creds
- BottleEK Stealer C2 Staging — [indicator] FTP Download, Tor Bundle Download and Community-Reported Sibling Infrastructure · unlock with TL Creds
- BottleEK Kit Component and Stealer Payload SHA256 Observed (main.js, vbs.vbs, swf.swf, Stealer, DLLs) · unlock with TL Creds
- Cinobi UAC Bypass via CMSTPLUA COM Interface (dllhost.exe Elevation Moniker) · unlock with TL Creds
- BottleEK/Cinobi C2 — Outbound Connections From Masqueraded [indicator] or [indicator] in User-Writable Paths (Tor Proxying) · unlock with TL Creds
- BottleEK/Cinobi Post-Exploitation — Masqueraded [indicator], [indicator] or [indicator] in User-Writable Paths and Renamed tor.exe · unlock with TL Creds
- BottleEK Stealer C2 — Onion Hosts, conn.php/rd.php/connect.php Beacons, Tor Bundle Download and BottleEK Infrastructure in HTTP Traffic · unlock with TL Creds
Indicators of compromise for Bottle EK exploit kit
As of 2026-11-07, Threadlinqs Intelligence tracks 23 indicators of compromise for TL-2026-5498.
Sample indicators (3 of 23)
- IP address:
139.180.136[.]22 - Domain:
priv[.]inteleksys[.]com - File hash:
588bb25acf86ac18323d800372bbdc0eb89ba3ce80ed3d891a9c41b8db93df26
Defanged, TLP:CLEAR. Full set of 23 indicators: unlock with TL Creds.
Community OSINT corroboration for Bottle EK exploit kit
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
How Bottle EK exploit kit works
Bottle Exploit Kit (BottleEK), named by nao_sec for the bottle image on its loading screen, was first reported publicly on 2019-12-12 and has been observed since at least September 2019. Victims are redirected to a BottleEK landing page via malvertising. The HTML landing page loads two JavaScript files: ajax.min.js (a JSONP communication handler) and main.js (obfuscated attack logic). The kit is strictly geofenced: if the navigator language does not contain "ja" it shows a fake login form and exits; it also only proceeds for Internet Explorer (MSIE or Trident/rv:11.0 user-agent signatures) and sets a cookie username=bingv to limit repeat infection attempts per user.
The landing page reports the IE version, whether the system is 64-bit, and the installed Adobe Flash Player version to the server, which responds with one of two exploits. The first is CVE-2018-8174, a VBScript engine use-after-free, implemented with address leaking, a ROP chain and an NtContinue-created context to reach arbitrary code execution. The second is CVE-2018-15982, an ActionScript use-after-free in Flash Player delivered as a SWF. Both variants carry the same shellcode, encoded with Shikata Ga Nai. The decoded shellcode resolves APIs via hashing (imul83hAdd), takes the download URL from a mutex-name string, saves an executable to %temp% as svchost.exe and runs it with WinExec.
The downloaded stealer first validates a Japanese environment with GetUserDefaultUILanguage, then downloads unzip.exe from legitimate FTP servers (ftp.cadwork.ch, freddy-ru.starlink.ru) and the Tor expert bundle tor-win32-0.3.5.8.zip from archive.torproject.org. It stages files in %temp% and C:\Users\Public and talks to onion C2 servers (5frjkvw2w3wv6dnv.onion via POST /conn.php and GET /rd.php; 4w6ylniamu6x7e3a.onion via POST /connect.php) using the user-agent "Mozilla/5.0 (Windows NT 6.1; WOW64)".
Trend Micro tied BottleEK to Operation Overtrap, a campaign against Japanese online banking users active since April 2019 that also used phishing emails and malvertising. From 2019-09-29 the payload was the Cinobi banking trojan: a four-stage infector that downloads Tor and unzip.exe, renames tor.exe to taskhost.exe, bypasses UAC via the CMSTPLUA COM interface, disables Windows Update-related services (UsoSvc, Wuauserv, WaaSMedicSvc, SecurityHealthService), installs as a Winsock Layered Service Provider and injects into browsers for form grabbing and web injects, with RC4 encryption using hardcoded keys. Trend Micro reported BottleEK as the most active exploit kit in Japan in February 2020. No attribution to a named actor is stated in the sources. The exploited flaws are old and patched; unpatched or end-of-life IE and Flash are the exposure.
MITRE ATT&CK techniques by tactic:
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1055.001 Process Injection: Dynamic-link Library Injection
Execution
T1059.005 Command and Scripting Interpreter: Visual Basic; T1059.007 Command and Scripting Interpreter: JavaScript; T1203 Exploitation for Client Execution
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1090.003 Proxy: Multi-hop Proxy
Privilege Escalation
T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control
Discovery
T1614.001 System Location Discovery: System Language Discovery
defense-impairment
Remediation for Bottle EK exploit kit
Patches
- Apply Microsoft's fix for CVE-2018-8174 (May 2018 security update)
- Apply Adobe Flash Player update APSB18-44 or later for CVE-2018-15982, or remove Flash
Immediate actions
- Block priv.inteleksys.com, sales.inteleksys.com, 139.180.136.22 and 139.99.115.204 at DNS, proxy and firewall
- Block or alert on outbound Tor traffic and on requests to .onion addresses from endpoints
- Alert on svchost.exe or taskhost.exe running from %TEMP%, C:\Users\Public or AppData\LocalLow
- Hunt for tor.exe renamed to taskhost.exe and for unzip.exe downloaded from FTP servers by user processes
Workarounds
- Disable VBScript execution in Internet Explorer via the Internet Zone setting
- Uninstall or disable Adobe Flash Player and disable IE as a default browser
Longer-term hardening
- Retire Internet Explorer and Adobe Flash Player from managed endpoints
- Deploy EDR with behavioral detection for browser child-process creation and shellcode-style WinExec downloads
- Use malvertising protection such as secure web gateway category filtering and ad blocking for Japanese user populations
- Monitor for new Winsock LSP / transport provider installations
Affected and fixed versions
- Microsoft — Internet Explorer (VBScript engine)
Vulnerable versions: Unpatched Internet Explorer prior to the CVE-2018-8174 fix
Fixed in: Systems with the CVE-2018-8174 security update applied - Adobe — Flash Player
Vulnerable versions: Flash Player builds prior to the CVE-2018-15982 fix
Fixed in: Flash Player builds including the CVE-2018-15982 fix, or Flash removed
Timeline of Bottle EK exploit kit
- Operation Overtrap, the campaign later linked to BottleEK, begins targeting Japanese online banking users (Trend Micro; month-level date)
- BottleEK activity observed in Japan-targeted malvertising from at least September 2019, initially with a clean payload (month-level date)
- BottleEK payload switches to delivering the locked-ioc-23 banking trojan (Trend Micro)
- nao_sec observes the new exploit kit, naming it Bottle EK after its loading-screen image
- nao_sec publishes 'Say hello to locked-ioc-15' with IOCs and exploit analysis
- Trend Micro reports BottleEK as the most active exploit kit detected in Japan in February 2020 (month-level date)
Sources cited for Bottle EK exploit kit
- Operation Overtrap Targets Japanese Online Banking Users Via Bottle Exploit Kit and Brand-New Cinobi Banking Trojan - Trend Micro Trend Micro · Research
- Tech Brief: Operation Overtrap Targets Japanese Online Banking Users - Trend Micro Trend Micro · Research
- Threat Coverage: How FortiEDR blocks web exploit kit BottleEK - Fortinet Fortinet · Vendor report
- Say hello to Bottle Exploit Kit - nao_sec nao-sec.org · Blog · 2019-12-12
- Exploit Kit still sharpens a sword - nao_sec nao-sec.pages.dev · Blog · 2021-04-01
- Rewterz Threat Alert: Operation Overtrap - Bottle Exploit Kit and Brand New Cinobi Banking Trojan rewterz.com · News
Drafted by the Threadlinqs research pipeline from 6 sources; published ; last updated —.
