[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftKPQ-TIVbmOoWecQkV6zax2RlpXySvu5a89id-wynKg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"2e603e82-df00-40fc-9e5b-4c1f25bc0668","seven-year-old-office-flaw-still-delivering-malware-via-phishing-emails","62fc0ff7-2035-4235-8dfd-35462c0d3d6f","Seven-Year-Old Office Flaw Still Delivering Malware via Phishing Emails","This campaign exploits CVE-2017-11882, a critical Microsoft Equation Editor vulnerability patched in November 2017, meaning any organization running it today has gone over seven years without applying a known, critical fix. Attackers combined this unpatched flaw with a convincing fake purchase order lure, relying on users opening malicious Word documents without suspicion. The multi-stage obfuscation and in-memory execution of XLoader make the payload harder to detect once the initial document is opened. This matters because XLoader is an information stealer capable of harvesting credentials, screenshots, and clipboard data, turning a single click into a significant data breach. The incident illustrates how the combination of poor patch discipline and low user awareness multiplies risk exponentially.","**Immediate actions:**\n- Apply the MS17-11882 patch (KB4048951) immediately on any remaining Office installations and verify patch status across all endpoints.\n- Block or sandbox all inbound email attachments containing macro-enabled or RTF-embedded Word documents at the email gateway.\n- Deploy endpoint detection and response (EDR) tooling capable of detecting in-memory payload execution and suspicious child processes spawned from Office applications.\n\n**Long-term improvements:**\n- Establish a vulnerability management program with SLA-enforced patching timelines (e.g., critical CVEs patched within 14 days) and regular compliance reporting.\n- Migrate users away from legacy Office versions that retain vulnerable components like Equation Editor, and use Attack Surface Reduction (ASR) rules in Defender to disable it.\n- Conduct regular phishing simulation exercises so employees recognize fake purchase order lures and report suspicious attachments before opening them.\n\n**Detection measures:**\n- Enable and centralise logging of Office process trees (e.g., WINWORD.EXE spawning cmd.exe or PowerShell) and alert on anomalous child-process behaviour.\n- Monitor Windows registry run keys for new persistence entries created outside of authorised software deployment processes.",[12,13,14,15,16],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 9: Email and Web Browser Protections (v8)","MITRE ATT&CK T1203: Exploitation for Client Execution","MITRE ATT&CK T1566.001: Spearphishing Attachment","NIS2 Article 21(2)(g)",{"NIS2 Article 21(2)(g)":18,"MITRE ATT&CK T1566.001: Spearphishing Attachment":19,"CIS Control 9: Email and Web Browser Protections (v8)":20,"MITRE ATT&CK T1203: Exploitation for Client Execution":21,"CIS Control 7: Continuous Vulnerability Management (v8)":22},"NIS2 Article 21(2)(g) mandates basic cyber hygiene and security training, which would address the user awareness gap that allowed employees to open fake purchase order attachments and trigger the exploit.","The campaign delivered the malicious RTF-embedded Word document as an email attachment disguised as a purchase order, which is the defining characteristic of this phishing sub-technique.","CIS Control 9 calls for filtering and blocking malicious email attachments at the gateway level, which would have stopped the fake purchase order document from reaching end users.","The attackers exploited CVE-2017-11882 in Microsoft Equation Editor specifically to execute code on the victim's machine when the malicious Word document was opened, matching this technique exactly.","CIS Control 7 requires organisations to continuously track and remediate known vulnerabilities; applying the 2017 Equation Editor patch would have directly prevented the initial exploitation step in this attack.","published","2026-11-13T15:21:38.781916+00:00","2026-11-13T15:21:38.757+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fcybersecuritynews.com\u002Ffake-purchase-order-emails\u002F","hackers-use-fake-purchase-order-emails-to-deliver-xloader-malware-through-malici-fb620b","Hackers Use Fake Purchase Order Emails to Deliver XLoader Malware Through Malicious Word Documents",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[45,48,52],{"slug":40,"name":46,"problem":47},"Automated patch management","Known holes get closed in days, not months.",{"slug":49,"name":50,"problem":51},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":53,"name":54,"problem":55},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]