BlackTech · vendor

Microsoft

4 CVEs · 4 in CISA KEV

Every dot is a CVE a source says this actor exploits; each name says which source. The named ones are the most at risk.

Connect AI

Open G0098 on attack.mitre.org

exploited in the wild: 4

Every one of the 4 is a mark on the map. Named now: 1 to 4, most at risk first.

The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 G…CVE-2012-0158Microsoft · CVSS 8.8 · 100% likely · ATT&CK T1203
CWE-94 Microsoft admin@338 Aoqin Dragon
Windows Server 2003 & IIS 6.0 - Remote Code ExecutionCVE-2017-7269Microsoft · CVSS 9.8 · 100% likely · ATT&CK T1190
CWE-120 Microsoft
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Window…CVE-2017-0199Microsoft Corporation · CVSS 7.8 · 99% likely · ATT&CK T1203
Microsoft APT37 APT41
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote a…CVE-2014-6352Microsoft · CVSS 7.8 · 77% likely · ATT&CK T1203
Microsoft

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: MITRE ATT&CK (© The MITRE Corporation, reproduced and distributed with its permission), the MISP Galaxy (CC0), and CyberSIXT's own coverage.