Roaming Tiger

1. CVE-2014-17612026-10-17

   1. “Use of RTF vulnerabilities (CVE-2012-0158 and CVE-2014-1761)”

      cited as exploiting · named nearby · source: 2014.zeronights.org ↗ · 2026-10-17

2. CVE-2012-01582026-10-17

   1. “As described in earlier reports on “Roaming Tiger”, the attack observed in August 2015 used weaponized exploit documents that leave Russian language decoy document files after infecting the system. The files exploit the well-known Microsoft Office vulnerability, CVE-2012-0158, to execute malicious code in order to take control of the targeted systems.”

      cited as used in a campaign · source: unit42.paloaltonetworks.com ↗ · 2026-10-17

   2. “Use of RTF vulnerabilities (CVE-2012-0158 and CVE-2014-1761)”

      cited as exploiting · named nearby · source: 2014.zeronights.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

1. 2015BBSRAT Attacks Targeting Russian Organizations Linked to Roaming TigerPalo Alto ↗
2. 2014The Rotten Tomato CampaignSophos ↗
3. 2014Roaming TigerESET ↗

1. 1.unit42.paloaltonetworks.com/bbsrat-attacks-targeting-russian-organizations-linked-…↗
2. 2.2014.zeronights.org/assets/files/slides/roaming_tiger_zeronights_2014.pdf↗
3. 3.secureworks.com/research/threat-profiles/bronze-woodland↗