Radio Exploit Kit drive-by download campaign exploiting CVE-2016-0189 to deliver AZORult

Key facts for Radio EK drive-by kit

Detection coverage for Radio EK drive-by kit

As of 2026-11-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5499 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Radio EK CVE-2016-0189 - Internet Explorer Spawning Script Interpreter

Detects Internet Explorer spawning PowerShell, wscript, cscript, cmd or mshta, the observable result of the Radio Exploit Kit (TL-2026-5499) CVE-2016-0189 VBScript exploit calling Shell.Application ShellExecute. Rows containing kit IOCs (radiobox-online.org, image.vbs2, 95.215.207.24) are flagged ioc_hit=1.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1189, T1203, T1059.005, T1059.001
• Data sources: sysmon, windows_security
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
    ParentImage="*\\iexplore.exe"
    (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\cmd.exe" OR Image="*\\mshta.exe")
| eval ioc_hit=if(match(CommandLine,"(?i)radiobox-online\.org|2no\.co|95\.215\.207\.24|45\.12\.215\.157|image\.vbs2|load2\.jpg|/im/[1-5]\.jpg|ShellExecute"),1,0)
| stats count min(_time) as firstTime max(_time) as lastTime values(CommandLine) as CommandLine by host, User, ParentImage, Image, ioc_hit
| convert ctime(firstTime) ctime(lastTime)
| sort 0 -ioc_hit -count

Microsoft KQL

let ioc_strings = dynamic(["radiobox-online.org", "2no.co", "95.215.207.24", "45.12.215.157", "image.vbs2", "load2.jpg", "/im/1.jpg", "/im/2.jpg", "/im/3.jpg", "/im/4.jpg", "/im/5.jpg"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "iexplore.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "cmd.exe", "mshta.exe")
| extend IocHit = ProcessCommandLine has_any (ioc_strings) or ProcessCommandLine has "ShellExecute"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, IocHit, SHA256
| order by IocHit desc, Timestamp desc

Sigma

title: Radio Exploit Kit CVE-2016-0189 - Internet Explorer Spawning Script Interpreter
id: 3f2a9c1e-7b4d-4e58-9a61-5c0d2e8b7a11
status: experimental
description: Detects Internet Explorer spawning PowerShell, Windows Script Host, cmd or mshta, the post-exploitation behaviour of the CVE-2016-0189 JScript/VBScript exploit used by Radio EK (TL-2026-5499) to run Shell.Application ShellExecute.
references:
    - http://nao-sec.org/2019/07/weak-dbd-attack-with-radioek.html
    - https://nvd.nist.gov/vuln/detail/CVE-2016-0189
    - https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-051
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/07
tags:
    - attack.initial-access
    - attack.t1189
    - attack.execution
    - attack.t1203
    - attack.t1059.005
    - attack.t1059.001
    - cve.2016-0189
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\iexplore.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\cmd.exe'
            - '\mshta.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legacy intranet applications that launch helper scripts from Internet Explorer
    - Browser-hosted administration or ActiveX tooling in legacy environments
level: high

Known false positives:

• Legacy intranet or line-of-business web apps that launch helper scripts from Internet Explorer
• Administrators using IE-hosted tooling that starts cmd.exe or PowerShell

Tuning notes: Exclude known internal application hosts by user or host; ioc_hit=1 rows are near-certain kit activity and can page, while ioc_hit=0 can be ticket-only. If IE runs in Protected Mode the parent may be explorer.exe, so also review explorer.exe parents on legacy fleets.

• 🔒 Radio EK CVE-2016-0189 - Internet Explorer Spawning Script Interpreter (Defender KQL) · unlock with TL Creds
• 🔒 Radio EK Stage-2 Script-Host PowerShell Downloader (AZORult Delivery) (Defender KQL) · unlock with TL Creds
• 🔒 Radio EK Infrastructure Network Contact ([indicator], [indicator], [indicator]) (Defender KQL) · unlock with TL Creds
• 🔒 Radio EK CVE-2016-0189 - Internet Explorer Spawning Script Interpreter (Sigma) · unlock with TL Creds
• 🔒 Radio EK Stage-2 Script-Host PowerShell Downloader (AZORult Delivery) (Sigma) · unlock with TL Creds
• 🔒 Radio EK Infrastructure Access In Web Proxy Logs (Sigma) · unlock with TL Creds
• 🔒 Radio EK Stage-2 Script-Host PowerShell Downloader (AZORult Delivery) · unlock with TL Creds
• 🔒 Radio EK Infrastructure Network Contact ([indicator], [indicator], [indicator]) · unlock with TL Creds

Indicators of compromise for Radio EK drive-by kit

As of 2026-11-07, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-5499.

Sample indicators (3 of 16)

• IP address: 95.215.207[.]24
• Domain: radiobox-online[.]org
• IP address: 45.12.215[.]157

Defanged, TLP:CLEAR. Full set of 16 indicators: unlock with TL Creds.

How Radio EK drive-by kit works

Since July 11, 2019, nao_sec observed a new drive-by download campaign built around an exploit kit they named the 'Radio Exploit Kit' (Radio EK), after its landing domain radiobox-online.org. Victims are redirected to the kit from an ad network (malvertising). The landing page runs code that exploits CVE-2016-0189, a memory-corruption flaw in the Microsoft JScript 5.8 and VBScript 5.7/5.8 engines as used in Internet Explorer 9-11. nao_sec describes the exploit code as unobfuscated and unrefined: it is essentially a public CVE-2016-0189 proof-of-concept used to push malware.

The exploit executes VBScript that calls Shell.Application's ShellExecute method, which launches PowerShell to download later stages. In version 1.0 (first seen 2019-07-11), the landing page fetches https://radiobox-online.org/images/image.vbs2. That script builds URLs by string concatenation and fetches load2.jpg. A second-stage script then downloads five numbered files (1.jpg to 5.jpg) in sequence, checks for an HTTP 200 response, saves each as an executable and runs it. Version 1.1 (2019-07-12) and later versions fetch from 95.215.207.24 (error.jp, then /im/1.jpg to /im/5.jpg), simplifying the chain to direct malware download. 2no.co, a URL shortener, was used for intermediate scripts. Payload hosting was also seen at 45.12.215.157/images/. The payloads are plain, unencrypted binaries identified as the AZORult information stealer.

nao_sec saw five updates between July 11 and 14, 2019 (v1.0, v1.1, v1.2.0, and v1.2.1 to v1.2.3), so the kit was under active development. Activity was often observed in Japan, which the researcher attributes partly to their regional focus. nao_sec rates Radio EK's attack capability as very low compared with RIG and Fallout, but warns that aggressive updates may follow. The source names no threat actor, so attribution is unknown. CVE-2016-0189 was patched in May 2016 (MS16-051 / MS16-053) and was later added to the CISA KEV catalog on 2022-03-28. The CVSS score and vector in this record are NVD's for the CVE, not a rating of the campaign.

MITRE ATT&CK techniques by tactic:

Execution

T1059.001 PowerShell; T1059.005 Visual Basic; T1203 Exploitation for Client Execution

Resource Development

T1583.008 Malvertising

Remediation for Radio EK drive-by kit

Patches

• Apply Microsoft security bulletins MS16-051 and MS16-053 for CVE-2016-0189

Immediate actions

• Block radiobox-online.org, 2no.co, 95.215.207.24 and 45.12.215.157 at DNS, proxy and firewall
• Search proxy and web logs for requests to /images/image.vbs2, /error.jp and /im/1.jpg to /im/5.jpg
• Investigate hosts with Internet Explorer spawning wscript.exe, powershell.exe or unsigned executables from user-writable paths, and treat any AZORult hit as credential exposure

Workarounds

• Disable or restrict VBScript execution in Internet Explorer zones
• Disable Windows Script Host where it is not needed

Longer-term hardening

• Retire Internet Explorer and the legacy JScript/VBScript engines where possible
• Use ad filtering or DNS filtering to reduce malvertising exposure
• Deploy EDR with behavioral detection for browser-spawned script interpreters

Affected and fixed versions

• Microsoft — Internet Explorer
  Vulnerable versions: 9; 10; 11
  Fixed in: Updates per MS16-051
• Microsoft — JScript / VBScript scripting engines
  Vulnerable versions: JScript 5.8; VBScript 5.7; VBScript 5.8
  Fixed in: Updates per MS16-051 and MS16-053

Timeline of Radio EK drive-by kit

• 2016-05-11 CVE-2016-0189 published; Microsoft addressed the JScript/VBScript flaw in bulletins MS16-051 and MS16-053
• 2019-07-11 locked-ioc-10 v1.0 first observed (about 10:00); landing page fetches locked-ioc-1
• 2019-07-12 Version 1.1 first observed (about 20:00), downloading from locked-ioc-2
• 2019-07-13 Version 1.2.0 first observed (about 14:00), downloading malware from locked-ioc-3
• 2019-07-14 Versions 1.2.1 to 1.2.3 observed between July 13 and 14; five kit updates in total over July 11-14
• 2019-07-15 nao_sec published 'Weak Drive-by Download attack with locked-ioc-10', describing the campaign and rating its attack capability very low
• 2022-03-28 CVE-2016-0189 added to the CISA Known Exploited Vulnerabilities catalog (due date 2022-04-18)

Sources cited for Radio EK drive-by kit

• NVD - CVE-2016-0189 NVD (NIST) · Advisory · 2016-05-11
• CISA Known Exploited Vulnerabilities Catalog (CVE-2016-0189) CISA · Government advisory · 2022-03-28
• Microsoft Security Bulletin MS16-051 Microsoft · Vendor report · 2016-05-10
• Microsoft Security Bulletin MS16-053 Microsoft · Vendor report · 2016-05-10
• The journey and evolution of God Mode in 2016: CVE-2016-0189 (Virus Bulletin) virusbulletin.com · Research · 2017-01-01
• urlscan.io public scan referencing Radio EK content urlscan.io · Research
• Exploit-DB 40118 - CVE-2016-0189 PoC exploit-db.com · Proof of concept
• Weak Drive-by Download attack with 'Radio Exploit Kit' (nao_sec) nao-sec.org · Blog · 2019-07-15
• Weak Drive-by Download attack with 'Radio Exploit Kit' (nao_sec mirror) nao-sec.pages.dev · Blog · 2019-07-15

More in malware

• YobaLoader Campaign: DLL Sideloading in Signed OpenAI/Anthropic-Themed Binaries via Fake GitHub Repositories Delivering XMRig
• Bottle Exploit Kit (BottleEK) - Malvertising Campaign Targeting Japanese Users via CVE-2018-8174 and CVE-2018-15982
• Exploit kits remain active in April 2021: RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude targeting Internet Explorer (CVE-2020-0674, CVE-2021-26411, CVE-2018-8174, CVE-2018-15982, CVE-2020-1380)
• Fake Security Tools on GitHub Deliver AsyncRAT, Clipper and Infostealer via Trojan.Loader.3261 Electron Loader (Microsoft.exe)
• GhostBat Android Banking Malware Targets 60 Banking and Payment Apps in India