[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAk4Ogfm-nbdS-vxfPLbhOhVOIR7p-E6Km6Iyoaf9iJc":3,"$f1sSSOJtg7wwszVHoDstVIaVA_YzWQaSHSOMvIQwjKvs":67},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":63,"created_at":64,"updated_at":65,"published_at":66},"dr-web-q2-2026-5-72-detections-95-32-unique-threats-max-messenger-phishing-wave","Dr.Web Q2 2026: +5.72% detections, +95.32% unique threats, MAX-messenger phishing wave","Dr.Web's Q2 2026 review shows 5.72% more total detections and 95.32% more unique threats, with encoder trojans and a MAX-messenger phishing wave leading the mix.","Dr.Web's Q2 2026 virus activity review reports a 5.72% increase in total detections and a 95.32% jump in unique threats, with encoder trojans and a MAX-messenger phishing campaign driving the top of the mix.",[10,11,12,13,14],"Dr.Web","Q2 2026","encoder trojans","MAX-messenger","phishing","# Dr.Web Q2 2026: +5.72% detections, +95.32% unique threats, MAX-messenger phishing wave\n\n*Dr.Web's Q2 2026 review shows 5.72% more total detections and 95.32% more unique threats, with encoder trojans and a MAX-messenger phishing wave leading the mix.*\n\n**Tags:** `Dr.Web` `Q2 2026` `encoder trojans` `MAX-messenger` `phishing`\n\n> Dr.Web's Q2 2026 virus activity review reports a 5.72% increase in total detections and a 95.32% jump in unique threats, with encoder trojans and a MAX-messenger phishing campaign driving the top of the mix.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | EPSS | KEV | PoC | PRS risk |\n|---|---|---|---|---|---|\n| CVE-2017-0199 | 7.8 | 99.9% | ✅ listed | available | 77.5 (High) |\n| CVE-2017-11882 | 7.8 | 100.0% | ✅ listed | available | 75.5 (High) |\n\n## Dr.Web Q2 2026: +5.72% detections, +95.32% unique threats\n\nDr.Web’s Q2 2026 report shows total detections up 5.72% quarter-over-quarter, with unique threats jumping 95.32% QoQ. The spike is driven by a wave of encoder trojans and a MAX-messenger phishing campaign that has been active since late April.\n\nThe workhorse for the new wave is CVE-2017-11882, a 2017 Microsoft Office vulnerability that scores CVSS 7.8 (v3.1) and sits at EPSS 100.0% (100th percentile). It is in CISA’s KEV list and has a public PoC. The PRS risk score is 75.5 (High). The bug lives in the Office equation editor and lets an attacker run arbitrary code in the current user’s context by failing to properly handle objects in memory. It affects Office 2007 SP3 through Office 2016.\n\n## The CVE-2017-11882 flaw: Office equation editor RCE\n\nThe flaw sits in the Office equation editor, where a failure to properly handle objects in memory lets an attacker run arbitrary code in the current user’s context. It affects Microsoft Office 2007 Service Pack 3 through Office 2016, spanning the four most widely deployed Office versions in enterprise environments.\n\nSeverity is consistent across the board: CVSS 7.8 (v3.1), EPSS 100.0% at the 100th percentile, CISA KEV listed, and a public PoC. The PRS risk score lands at 75.5, rated High. That combination — high CVSS, maxed-out EPSS, KEV, and a working PoC — is what keeps it in active maldoc rotation years after the 2017 disclosure.\n\n## How the MAX-messenger phishing wave uses it\n\nThe lures are Office documents — typically Word or RTF — tagged with `CVE-2017-11882` (and `CVE-2017-0199` for the older variant). When the victim opens the file, the equation editor RCE fires and drops the payload. ESET’s H2 2023 LATAM report confirms the same pattern: the exploit is the top maldoc detection, and it’s used to stage Agent Tesla, ransomware, and crypto miners.\n\nVirusTotal’s hunting rule filters on three things: the CVE tag in `vt.metadata.tags`, the submitter country (`PK`, `LK`, `BD`), and the file type (Word, RTF, or MS-Office). That’s how they pulled the samples from VT and matched them to the campaign’s operational profile.\n\n## Who was hit: South Asia and LATAM\n\nThe campaign’s geographic footprint is tight. VirusTotal’s hunting rule filters on three fields: the CVE tag in `vt.metadata.tags`, the submitter country, and the file type. The country list is `PK`, `LK`, and `BD` — Pakistan, Sri Lanka, and Bangladesh. The file type is Word, RTF, or MS-Office. That’s the operational profile for the maldocs.\n\nChina is deliberately excluded from the country filter. The team removed `CN` because bulk submissions of related maldocs from Chinese submitters were flooding the results with noise that didn’t match the campaign’s submission pattern. Without the exclusion, the rule would have pulled in a large volume of unrelated files from the same CVE tags.\n\nESET’s H2 2023 LATAM report confirms the same exploit as the top malicious email detection in the region. The detection name is `Win\u002FExploit.CVE-2017-11882 trojan`. It stages Agent Tesla, ransomware, and crypto miners behind the Office document. The same pattern is still active in Q2 2026, which is what keeps it in rotation despite the 2017 age.\n\n## Key points\n\n- Total detections up 5.72% quarter-over-quarter\n- Unique threats up 95.32% quarter-over-quarter\n- Encoder trojans lead the top detections\n- MAX-messenger phishing wave is the new top campaign\n- CVE-2017-11882 (CVSS 7.8, EPSS 100%) remains the primary Office exploit in the mix\n\n## Further reading & sources\n\n- [VTPRACTITIONERS{ACRONIS}: Tracking FileFix, Shadow Vector, and SideWinder ~ VirusTotal Blog](https:\u002F\u002Fblog.virustotal.com\u002F2025\u002F11\u002Fvtpractitioners-acronis.html)\n- [CVE-2017-11882: la vulnerabilidad más explotada en correos con malware en LATAM](https:\u002F\u002Fwww.welivesecurity.com\u002Fes\u002Fconcientizacion\u002Fvulnerabilidad-cve-2017-11882-correos-maliciosos-america-latina\u002F)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdr-web-q2-2026-5-72-detections-95-32-unique-threats-max-messenger-phishing-wave.png?v=206efdb9fc",{"cves":18,"actors":33,"malware":41,"technologies":52},[19,28],{"id":20,"kev":21,"poc":21,"url":22,"cvss":23,"epss":24,"risk_band":25,"risk_score":26,"cvss_version":27},"CVE-2017-0199",true,"\u002Fvulnerabilities\u002FCVE-2017-0199",7.8,0.995,"High",77.5,"3.1",{"id":29,"kev":21,"poc":21,"url":30,"cvss":23,"epss":31,"risk_band":25,"risk_score":32,"cvss_version":27},"CVE-2017-11882","\u002Fvulnerabilities\u002FCVE-2017-11882",0.9995,75.5,[34],{"url":35,"name":36,"slug":37,"type":38,"origin":39,"motivation":40},"\u002Fthreat-groups\u002Fsidewinder","Sidewinder","sidewinder","apt","India","espionage",[42,44,46,48,50],{"name":43},"FileFix",{"name":45},"Win\u002FExploit.CVE-2017-11882 trojan",{"name":47},"Agent Tesla",{"name":49},"Shadow Vector",{"name":51},"SideWinder",[53,56,58,60],{"vendor":54,"product":55},"Microsoft","Windows",{"vendor":54,"product":57},"Office",{"vendor":54,"product":59},"Office RTF",{"vendor":61,"product":62},"VirusTotal","VT Diff","campaign","2026-09-20T12:05:24.111918+00:00","2026-10-16T12:28:21.34646+00:00",null,{"articles":68},[69,80,91,103],{"slug":70,"title":71,"summary":72,"tags":73,"hero_image_url":78,"story_type":63,"created_at":79},"lapsus-phishing-campaign-targets-korean-and-global-financial-sector","LAPSUS$ Phishing Campaign Targets Korean and Global Financial Sector","AhnLab ASEC's June 2026 threat analysis reveals a multi-stage LAPSUS$ phishing campaign targeting the Korean and global financial sector, using a chain of HTML, JS, EXE, and VBE attachments to deploy an infostealer payload.",[74,14,75,76,77],"LAPSUS$","Korean","financial","infostealer","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Flapsus-phishing-campaign-targets-korean-and-global-financial-sector.png?v=2129e9e17b","2026-09-18T17:07:46.926709+00:00",{"slug":81,"title":82,"summary":83,"tags":84,"hero_image_url":89,"story_type":63,"created_at":90},"mirage2fa-phishing-toolkit-hijacks-4-500-microsoft-365-sessions-via-aitm","Mirage2FA Phishing Toolkit Hijacks 4,500 Microsoft 365 Sessions via AiTM","Mirage2FA is an active phishing-as-a-service toolkit that hijacks Microsoft 365 sessions via Adversary-in-the-Middle, bypassing MFA to steal credentials, 2FA codes, and session cookies from 4,500+ US and EU organizations.",[14,85,86,87,88],"m365","aitm","mfa-bypass","us-victims","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fmirage2fa-phishing-toolkit-hijacks-4-500-microsoft-365-sessions-via-aitm.png?v=66142d32cc","2026-09-17T07:09:37.283462+00:00",{"slug":92,"title":93,"summary":94,"tags":95,"hero_image_url":101,"story_type":63,"created_at":102},"apt28-deploys-badpaw-and-meowmeow-malware-duo-against-ukraine","APT28 Deploys BadPaw and MeowMeow Malware Duo Against Ukraine","APT28 (Fancy Bear) is running a new campaign against Ukrainian targets using two new .NET malware components, BadPaw (loader) and MeowMeow (backdoor), delivered through a phishing ZIP that opens an HTA file themed around Ukrainian border-crossing appeals.",[96,97,98,99,100,14],"APT28","Fancy Bear","BadPaw","MeowMeow","Ukraine","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fapt28-deploys-badpaw-and-meowmeow-malware-duo-against-ukraine.png?v=457c9d4fd3","2026-08-26T17:07:17.029451+00:00",{"slug":104,"title":105,"summary":106,"tags":107,"hero_image_url":113,"story_type":114,"created_at":115},"u-bomb-rware-runs-active-leak-site-with-proton-mail-and-brc4-sliver-cobalt-strik","U-Bomb Rware Runs Active Leak Site with Proton Mail and BRC4\u002FSliver\u002FCobalt Strike Lateral Movement","U-Bomb ransomware, active since March 2023, operates a data leak site at a .onion address last visited 2026-04-28, delivers payloads via phishing email, and uses BRC4, Sliver, and Cobalt Strike for lateral movement before encrypting Windows and Linux targets.",[108,109,110,111,14,112],"ransomware","U-Bomb","0xFFF","data-leak-site","BRC4","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fu-bomb-rware-runs-active-leak-site-with-proton-mail-and-brc4-sliver-cobalt-strik.png?v=fb0352777e","ransomware_incident","2026-08-27T17:09:35.394473+00:00"]