# Bottle Exploit Kit (BottleEK) - Malvertising Campaign Targeting Japanese Users via CVE-2018-8174 and CVE-2018-15982

> Bottle EK is a Japan-only exploit kit spread through malvertising. It exploits Internet Explorer (CVE-2018-8174) and Adobe Flash Player (CVE-2018-15982) and only fires when the browser language contains "ja" and the user-agent is Internet Explorer. Its payload is a stealer that fetches Tor and communicates with onion C2 servers; from 2019-09-29 Trend Micro saw it deliver the Cinobi banking trojan as part of Operation Overtrap.

- **Published:** 2026-11-07T08:32:10Z
- **Last reviewed:** 2026-11-07T08:32:10Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5498
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5498.png
- **ID:** TL-2026-5498
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 23 (3 shown free below)
- **CVEs:** CVE-2018-8174, CVE-2018-15982

## Description

Bottle Exploit Kit (BottleEK), named by nao_sec for the bottle image on its loading screen, was first reported publicly on 2019-12-12 and has been observed since at least September 2019. Victims are redirected to a BottleEK landing page via malvertising. The HTML landing page loads two JavaScript files: ajax.min.js (a JSONP communication handler) and main.js (obfuscated attack logic). The kit is strictly geofenced: if the navigator language does not contain "ja" it shows a fake login form and exits; it also only proceeds for Internet Explorer (MSIE or Trident/rv:11.0 user-agent signatures) and sets a cookie username=bingv to limit repeat infection attempts per user.

The landing page reports the IE version, whether the system is 64-bit, and the installed Adobe Flash Player version to the server, which responds with one of two exploits. The first is CVE-2018-8174, a VBScript engine use-after-free, implemented with address leaking, a ROP chain and an NtContinue-created context to reach arbitrary code execution. The second is CVE-2018-15982, an ActionScript use-after-free in Flash Player delivered as a SWF. Both variants carry the same shellcode, encoded with Shikata Ga Nai. The decoded shellcode resolves APIs via hashing (imul83hAdd), takes the download URL from a mutex-name string, saves an executable to %temp% as svchost.exe and runs it with WinExec.

The downloaded stealer first validates a Japanese environment with GetUserDefaultUILanguage, then downloads unzip.exe from legitimate FTP servers (ftp.cadwork.ch, freddy-ru.starlink.ru) and the Tor expert bundle tor-win32-0.3.5.8.zip from archive.torproject.org. It stages files in %temp% and C:\Users\Public and talks to onion C2 servers (5frjkvw2w3wv6dnv.onion via POST /conn.php and GET /rd.php; 4w6ylniamu6x7e3a.onion via POST /connect.php) using the user-agent "Mozilla/5.0 (Windows NT 6.1; WOW64)".

Trend Micro tied BottleEK to Operation Overtrap, a campaign against Japanese online banking users active since April 2019 that also used phishing emails and malvertising. From 2019-09-29 the payload was the Cinobi banking trojan: a four-stage infector that downloads Tor and unzip.exe, renames tor.exe to taskhost.exe, bypasses UAC via the CMSTPLUA COM interface, disables Windows Update-related services (UsoSvc, Wuauserv, WaaSMedicSvc, SecurityHealthService), installs as a Winsock Layered Service Provider and injects into browsers for form grabbing and web injects, with RC4 encryption using hardcoded keys. Trend Micro reported BottleEK as the most active exploit kit in Japan in February 2020. No attribution to a named actor is stated in the sources. The exploited flaws are old and patched; unpatched or end-of-life IE and Flash are the exposure.

## MITRE ATT&CK

- T1203 Exploitation for Client Execution
- T1059.005 Command and Scripting Interpreter: Visual Basic
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1027 Obfuscated Files or Information
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1685 Disable or Modify Tools
- T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control
- T1055.001 Process Injection: Dynamic-link Library Injection
- T1614.001 System Location Discovery: System Language Discovery
- T1071.001 Application Layer Protocol: Web Protocols
- T1090.003 Proxy: Multi-hop Proxy

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**BottleEK Exploitation — Internet Explorer Spawning Masqueraded svchost.exe (CVE-2018-8174 / CVE-2018-15982)** (`TL-2026-5498-SPL-001`)

Detects the BottleEK (TL-2026-5498) post-exploit shellcode stage: after the CVE-2018-8174 VBScript or CVE-2018-15982 Flash use-after-free fires inside Internet Explorer, the Shikata Ga Nai shellcode saves the stealer as svchost.exe in %TEMP% and launches it via WinExec. The real svchost.exe is always started by services.exe from System32/SysWOW64 and is never a child of iexplore.exe, so any iexplore.exe -> svchost.exe process outside the system directories is a high-fidelity drive-by exploitation signal.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1203, T1036.005, T1189
- **Data sources:** sysmon, index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1, DeviceProcessEvents
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
    ParentImage="*\\iexplore.exe" Image="*\\svchost.exe"
```BottleEK shellcode drops the stealer as svchost.exe in the user temp dir; legitimate svchost lives only in System32 or SysWOW64```
| where NOT match(lower(Image),"^c:\\\\windows\\\\(system32|syswow64)\\\\svchost\\.exe$")
| eval staging_dir=case(match(lower(Image),"\\\\temp\\\\"),"temp", match(lower(Image),"\\\\users\\\\public\\\\"),"public", match(lower(Image),"\\\\locallow\\\\"),"locallow", true(),"other")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as cmdlines values(Hashes) as hashes by host User ParentImage Image staging_dir
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "iexplore.exe"
| where FileName =~ "svchost.exe"
// legitimate svchost only runs from the system directories
| where FolderPath !in~ (@"c:\windows\system32\svchost.exe", @"c:\windows\syswow64\svchost.exe")
| extend StagingDir = case(FolderPath contains @"\temp\", "temp", FolderPath contains @"\users\public\", "public", FolderPath contains @"\locallow\", "locallow", "other")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, ProcessCommandLine, SHA256, StagingDir
```

### Sigma

```yaml
title: BottleEK Internet Explorer Spawning Masqueraded svchost.exe
id: 3f6a1c52-8d4e-4b27-9a61-5c0e7d2b94a1
status: experimental
description: Detects Internet Explorer spawning an svchost.exe outside System32/SysWOW64, the BottleEK shellcode stage that follows CVE-2018-8174 or CVE-2018-15982 exploitation (TL-2026-5498).
references:
    - http://nao-sec.org/2019/12/say-hello-to-bottle-exploit-kit.html
    - https://www.trendmicro.com/en_us/research/20/c/operation-overtrap-targets-japanese-online-banking-users-via-bot.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/07
tags:
    - attack.execution
    - attack.t1203
    - attack.defense_evasion
    - attack.t1036.005
    - attack.initial_access
    - attack.t1189
    - cve.2018-8174
    - cve.2018-15982
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\iexplore.exe'
        Image|endswith: '\svchost.exe'
    filter_system:
        Image|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
    condition: selection and not filter_system
falsepositives:
    - Unlikely; no legitimate workflow starts svchost.exe from Internet Explorer
    - Custom software that installs a service-host copy from a browser download (very rare)
level: high

```

**Known false positives:**

- Software-installer test harnesses that copy a renamed service host from a browser session
- Security-lab or red-team simulations of drive-by delivery

**Tuning notes:** Requires Sysmon EventCode 1 with ParentImage. Change index=sysmon to match your Sysmon index. If IE is fully retired in your estate, extend ParentImage to other legacy browser hosts and raise alert priority. Exclude documented lab hosts by host name.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- BottleEK Exploitation — Endpoint Connections to BottleEK Landing/Exploit Infrastructure (inteleksys.com) (locked: unlock with TL Creds)
- Cinobi Post-Exploitation — Windows Update and Security Health Services Disabled (UsoSvc, wuauserv, WaaSMedicSvc, SecurityHealthService) (locked: unlock with TL Creds)
- BottleEK Stealer C2 Staging — [indicator] FTP Download, Tor Bundle Download and Community-Reported Sibling Infrastructure (locked: unlock with TL Creds)
- BottleEK Kit Component and Stealer Payload SHA256 Observed (main.js, vbs.vbs, swf.swf, Stealer, DLLs) (locked: unlock with TL Creds)
- Cinobi UAC Bypass via CMSTPLUA COM Interface (dllhost.exe Elevation Moniker) (locked: unlock with TL Creds)
- BottleEK/Cinobi C2 — Outbound Connections From Masqueraded [indicator] or [indicator] in User-Writable Paths (Tor Proxying) (locked: unlock with TL Creds)
- BottleEK/Cinobi Post-Exploitation — Masqueraded [indicator], [indicator] or [indicator] in User-Writable Paths and Renamed tor.exe (locked: unlock with TL Creds)
- BottleEK Stealer C2 — Onion Hosts, conn.php/rd.php/connect.php Beacons, Tor Bundle Download and BottleEK Infrastructure in HTTP Traffic (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 23)

Defanged, TLP:CLEAR.

- IP address: `139.180.136[.]22`
- Domain: `priv[.]inteleksys[.]com`
- File hash: `588bb25acf86ac18323d800372bbdc0eb89ba3ce80ed3d891a9c41b8db93df26`

Full set of 23 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Say hello to Bottle Exploit Kit - nao_sec](http://nao-sec.org/2019/12/say-hello-to-bottle-exploit-kit.html)
- [Operation Overtrap Targets Japanese Online Banking Users Via Bottle Exploit Kit and Brand-New Cinobi Banking Trojan - Trend Micro](https://www.trendmicro.com/en_us/research/20/c/operation-overtrap-targets-japanese-online-banking-users-via-bot.html)
- [Tech Brief: Operation Overtrap Targets Japanese Online Banking Users - Trend Micro](https://documents.trendmicro.com/assets/pdf/Tech%20Brief_Operation%20Overtrap%20Targets%20Japanese%20Online%20Banking%20Users.pdf)
- [Rewterz Threat Alert: Operation Overtrap - Bottle Exploit Kit and Brand New Cinobi Banking Trojan](https://rewterz.com/rewterz-news/rewterz-threat-alert-operation-overtrap-bottle-exploit-kit-and-brand-new-cinobi-banking-trojan)
- [Threat Coverage: How FortiEDR blocks web exploit kit BottleEK - Fortinet](https://community.fortinet.com/t5/FortiEDR/Threat-Coverage-How-FortiEDR-blocks-web-exploit-kit-BottleEK/ta-p/198097)
- [Exploit Kit still sharpens a sword - nao_sec](https://nao-sec.pages.dev/2021/04/exploit-kit-still-sharpens-a-sword.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5498