IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Hackers exploit Windows zero-day to target users with Office files

This ‘reliable and dangerous’ flaw is being abused to launch remote code execution attacks against specific targets

Microsoft has warned that cyber criminals are exploiting an Internet Explorer flaw to target victims with specially-crafted Microsoft Office documents.

The vulnerability tracked as CVE-2021-40444 is a remote code execution zero-day embedded in MSHTML, also known as the browser engine Trident that powers the now-retired Windows version of Internet Explorer. 

It’s rated 8.8 out of ten on the CVSS scale and is under limited and targeted exploitation, according to a security alert released by the company.

Exploitation involves an attacker crafting a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. 

ActiveX controls are small programmes, or add-ons, for Internet Explorer and other Windows applications used to build out feature sets and add more functionality. 

Once the attacker has written the malicious ActiveX control, to successfully exploit this flaw they would need to convince a user to open the malicious file. 

The vulnerability was first detected by Mandiant and EXPMON, with Microsoft refraining to disclose additional exploitation details as well as the identity of the victims exploited by the limited, targeted attacks.

EXPMON has described the exploit as “a highly sophisticated zero-day attack”, and has recommended that Microsoft Office users don’t open any files unless they trust the source. 

Related Resource

Ransomware report

The global state of the channel

Global state of the channel - ransomware report from DattoDownload now

The firm has reproduced the attack on the latest Office 2019 and Office 365 suites on Windows 10. The researchers also said this exploit uses “logical flaws” so the exploitation is perfectly reliable and dangerous.

Users whose accounts are configured to have fewer user rights on the system won’t be as badly affected as those who retain administrative privileges, however.

There are a couple of additional mitigations that Microsoft has advised users could prevent exploitation, including opening all documents from the internet in Protected View or through Application Guard. Both of these methods will prevent the current attack.

The firm has also recommended that users disable the installation of all ActiveX controls in Internet Explorer. This can be accomplished for all sites by updating the registry. Previously installed ActiveX controls will continue to run, but these don’t expose this vulnerability.

Users need to take care, though, as using the Registry Editor incorrectly might lead to serious problems that require users to reinstall their operating systems.

Featured Resources

2023 Strategic roadmap for data security platform convergence

Capitalise on your data and share it securely using consolidated platforms

Free Download

The 3D trends report

Presenting one of the most exciting frontiers in visual culture

Free Download

The Total Economic Impact™ of IBM Cloud Pak® for Watson AIOps with Instana

Cost savings and business benefits

Free Download

Leverage automated APM to accelerate CI/CD and boost application performance

Constant change to meet fast-evolving application functionality

Free Download

Recommended

ChatGPT-powered Bing, Edge: A 'race against time' to dethrone Google
artificial intelligence (AI)

ChatGPT-powered Bing, Edge: A 'race against time' to dethrone Google

8 Feb 2023
Microsoft Azure spending notifications unavailable until March
Cloud

Microsoft Azure spending notifications unavailable until March

2 Feb 2023
Hackers target business cloud environments by abusing Microsoft’s ‘verified publisher’ status
Security

Hackers target business cloud environments by abusing Microsoft’s ‘verified publisher’ status

1 Feb 2023
Google to cut global workforce by 12,000 roles
Careers & training

Google to cut global workforce by 12,000 roles

20 Jan 2023

Most Popular

Warning issued over ransomware attacks targeting VMware ESXi servers globally
cyber attacks

Warning issued over ransomware attacks targeting VMware ESXi servers globally

6 Feb 2023
ION Trading reportedly pays LockBit ransom demands
ransomware

ION Trading reportedly pays LockBit ransom demands

6 Feb 2023
Tips for Boosting your Organisation’s Security Posture with Encryption
Sponsored

Tips for Boosting your Organisation’s Security Posture with Encryption

6 Feb 2023