Trusted Design

Microsoft Word Intruder: Operation Pony Express

概要

The infection kit, known as Microsoft Word Intruder (MWI), tries to rig up those crashes so that MWI itself takes control over from Word during the crash, thus exploiting the vulnerability to install malware. Here's one set of malware campaigns, Operation Pony Express, which ran in April and May 2015. Pony Express used spear-phishing email campaigns in which booby-trapped RTF (Rich Text Format) documents were send out to prospective victims. Spear-phishing, also known as a "targeted attack", means sending out spoofed, infected emails that ring some sort of bell with the recipient.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• The KeyBoys are back in town (score: 0.66)
• Malware delivered via Necurs botnet by DDE feature in Microsoft Word (score: 0.66)
• Tracing Pony’s Threat Cycle and Multi-Stage Infection Chain (score: 0.66)
• Infy Malware Active In Decade of Targeted Attacks (score: 0.66)
• Enterprises Hit by BARTALEX Macro Malware (score: 0.65)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る