# Radio Exploit Kit drive-by download campaign exploiting CVE-2016-0189 to deliver AZORult

> nao_sec reported a weak drive-by download campaign using the 'Radio Exploit Kit' (Radio EK), reached via malvertising redirects from an ad network. The kit runs an unrefined CVE-2016-0189 proof-of-concept and uses multi-stage VBScript/PowerShell downloaders to deliver unencrypted AZORult payloads, mostly observed in Japan, with several kit versions seen July 11-14, 2019.

- **Published:** 2026-11-07T08:57:13Z
- **Last reviewed:** 2026-11-07T08:57:13Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5499
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5499.png
- **ID:** TL-2026-5499
- **Severity:** MEDIUM (CVSS 7.5)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 16 (3 shown free below)
- **CVEs:** CVE-2016-0189

## Description

Since July 11, 2019, nao_sec observed a new drive-by download campaign built around an exploit kit they named the 'Radio Exploit Kit' (Radio EK), after its landing domain radiobox-online.org. Victims are redirected to the kit from an ad network (malvertising). The landing page runs code that exploits CVE-2016-0189, a memory-corruption flaw in the Microsoft JScript 5.8 and VBScript 5.7/5.8 engines as used in Internet Explorer 9-11. nao_sec describes the exploit code as unobfuscated and unrefined: it is essentially a public CVE-2016-0189 proof-of-concept used to push malware.

The exploit executes VBScript that calls Shell.Application's ShellExecute method, which launches PowerShell to download later stages. In version 1.0 (first seen 2019-07-11), the landing page fetches https://radiobox-online.org/images/image.vbs2. That script builds URLs by string concatenation and fetches load2.jpg. A second-stage script then downloads five numbered files (1.jpg to 5.jpg) in sequence, checks for an HTTP 200 response, saves each as an executable and runs it. Version 1.1 (2019-07-12) and later versions fetch from 95.215.207.24 (error.jp, then /im/1.jpg to /im/5.jpg), simplifying the chain to direct malware download. 2no.co, a URL shortener, was used for intermediate scripts. Payload hosting was also seen at 45.12.215.157/images/. The payloads are plain, unencrypted binaries identified as the AZORult information stealer.

nao_sec saw five updates between July 11 and 14, 2019 (v1.0, v1.1, v1.2.0, and v1.2.1 to v1.2.3), so the kit was under active development. Activity was often observed in Japan, which the researcher attributes partly to their regional focus. nao_sec rates Radio EK's attack capability as very low compared with RIG and Fallout, but warns that aggressive updates may follow. The source names no threat actor, so attribution is unknown. CVE-2016-0189 was patched in May 2016 (MS16-051 / MS16-053) and was later added to the CISA KEV catalog on 2022-03-28. The CVSS score and vector in this record are NVD's for the CVE, not a rating of the campaign.

## MITRE ATT&CK

- T1583.008 Malvertising
- T1203 Exploitation for Client Execution
- T1059.005 Visual Basic
- T1059.001 PowerShell

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Radio EK CVE-2016-0189 - Internet Explorer Spawning Script Interpreter** (`TL-2026-5499-SPL-001`)

Detects Internet Explorer spawning PowerShell, wscript, cscript, cmd or mshta, the observable result of the Radio Exploit Kit (TL-2026-5499) CVE-2016-0189 VBScript exploit calling Shell.Application ShellExecute. Rows containing kit IOCs (radiobox-online.org, image.vbs2, 95.215.207.24) are flagged ioc_hit=1.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1189, T1203, T1059.005, T1059.001
- **Data sources:** sysmon, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
    ParentImage="*\\iexplore.exe"
    (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\cmd.exe" OR Image="*\\mshta.exe")
| eval ioc_hit=if(match(CommandLine,"(?i)radiobox-online\.org|2no\.co|95\.215\.207\.24|45\.12\.215\.157|image\.vbs2|load2\.jpg|/im/[1-5]\.jpg|ShellExecute"),1,0)
| stats count min(_time) as firstTime max(_time) as lastTime values(CommandLine) as CommandLine by host, User, ParentImage, Image, ioc_hit
| convert ctime(firstTime) ctime(lastTime)
| sort 0 -ioc_hit -count
```

### Microsoft KQL

```kql
let ioc_strings = dynamic(["radiobox-online.org", "2no.co", "95.215.207.24", "45.12.215.157", "image.vbs2", "load2.jpg", "/im/1.jpg", "/im/2.jpg", "/im/3.jpg", "/im/4.jpg", "/im/5.jpg"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "iexplore.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "cmd.exe", "mshta.exe")
| extend IocHit = ProcessCommandLine has_any (ioc_strings) or ProcessCommandLine has "ShellExecute"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, IocHit, SHA256
| order by IocHit desc, Timestamp desc
```

### Sigma

```yaml
title: Radio Exploit Kit CVE-2016-0189 - Internet Explorer Spawning Script Interpreter
id: 3f2a9c1e-7b4d-4e58-9a61-5c0d2e8b7a11
status: experimental
description: Detects Internet Explorer spawning PowerShell, Windows Script Host, cmd or mshta, the post-exploitation behaviour of the CVE-2016-0189 JScript/VBScript exploit used by Radio EK (TL-2026-5499) to run Shell.Application ShellExecute.
references:
    - http://nao-sec.org/2019/07/weak-dbd-attack-with-radioek.html
    - https://nvd.nist.gov/vuln/detail/CVE-2016-0189
    - https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-051
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/07
tags:
    - attack.initial-access
    - attack.t1189
    - attack.execution
    - attack.t1203
    - attack.t1059.005
    - attack.t1059.001
    - cve.2016-0189
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\iexplore.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\cmd.exe'
            - '\mshta.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legacy intranet applications that launch helper scripts from Internet Explorer
    - Browser-hosted administration or ActiveX tooling in legacy environments
level: high

```

**Known false positives:**

- Legacy intranet or line-of-business web apps that launch helper scripts from Internet Explorer
- Administrators using IE-hosted tooling that starts cmd.exe or PowerShell

**Tuning notes:** Exclude known internal application hosts by user or host; ioc_hit=1 rows are near-certain kit activity and can page, while ioc_hit=0 can be ticket-only. If IE runs in Protected Mode the parent may be explorer.exe, so also review explorer.exe parents on legacy fleets.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Radio EK CVE-2016-0189 - Internet Explorer Spawning Script Interpreter (Defender KQL) (locked: unlock with TL Creds)
- Radio EK Stage-2 Script-Host PowerShell Downloader (AZORult Delivery) (Defender KQL) (locked: unlock with TL Creds)
- Radio EK Infrastructure Network Contact ([indicator], [indicator], [indicator]) (Defender KQL) (locked: unlock with TL Creds)
- Radio EK CVE-2016-0189 - Internet Explorer Spawning Script Interpreter (Sigma) (locked: unlock with TL Creds)
- Radio EK Stage-2 Script-Host PowerShell Downloader (AZORult Delivery) (Sigma) (locked: unlock with TL Creds)
- Radio EK Infrastructure Access In Web Proxy Logs (Sigma) (locked: unlock with TL Creds)
- Radio EK Stage-2 Script-Host PowerShell Downloader (AZORult Delivery) (locked: unlock with TL Creds)
- Radio EK Infrastructure Network Contact ([indicator], [indicator], [indicator]) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 16)

Defanged, TLP:CLEAR.

- IP address: `95.215.207[.]24`
- Domain: `radiobox-online[.]org`
- IP address: `45.12.215[.]157`

Full set of 16 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Weak Drive-by Download attack with 'Radio Exploit Kit' (nao_sec)](http://nao-sec.org/2019/07/weak-dbd-attack-with-radioek.html)
- [Weak Drive-by Download attack with 'Radio Exploit Kit' (nao_sec mirror)](https://nao-sec.pages.dev/2019/07/weak-dbd-attack-with-radioek.html)
- [NVD - CVE-2016-0189](https://nvd.nist.gov/vuln/detail/CVE-2016-0189)
- [CISA Known Exploited Vulnerabilities Catalog (CVE-2016-0189)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Microsoft Security Bulletin MS16-051](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-051)
- [Microsoft Security Bulletin MS16-053](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-053)
- [Exploit-DB 40118 - CVE-2016-0189 PoC](https://www.exploit-db.com/exploits/40118)
- [The journey and evolution of God Mode in 2016: CVE-2016-0189 (Virus Bulletin)](https://www.virusbulletin.com/virusbulletin/2017/01/journey-and-evolution-god-mode-2016-cve-2016-0189)
- [urlscan.io public scan referencing Radio EK content](https://urlscan.io/result/87864d3f-672a-42dc-a61f-2f25ca0f7ae8/content)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5499