MS09-002 in the wild
Summary: Cisco Talos reported finding a website on the domain of Morning Sun (Tianjin) Int'l Trading Co., Ltd exploiting MS09-002, an Internet Explorer programming error Microsoft patched on February 10, 2009, to run a script that downloads an executable before crashing the browser. The dropped file, detected by ClamAV as Trojan.Rincux-2, installs winnet.dll as a Winlogon notification package via a registry key and makes outbound requests to jiaozhu100.9966.org, and by 11AM EST on Feb 19, 2009 a second Chinese site, Hwa Jiang International Co. Ltd, was pushing WinUpdter.exe from the %temp% folder with a Run key named WindowsUpdater.
Why it matters: A patched-in-a-day IE flaw was already in the wild on at least two company websites, and the second payload hid behind a registry value named to look like Microsoft's own.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026