Home » exploit kit

New Disdain Exploit Kit Detected in the Wild

Posted on:August 17, 2017 at 12:38 am
Posted in:Exploits
Author:
Trend Micro

The exploit kit landscape has been rocky since 2016, and we’ve observed several of the major players—Angler, Nuclear, Neutrino, Sundown—take a dip in operations or go private. New kits have popped up sporadically since then, sometimes revamped from old sources, but none have really gained traction. Despite that fact, cybercriminals continue to develop more of them.

On August 9, we detected a new exploit kit in the wild, being distributed through a malvertising campaign. With additional analysis of the code and activity, we can confirm that it is the Disdain exploit kit, which started to advertise their services in underground forums starting August 8. We found the “disdain” keyword contained in its JavaScript code.

Posted on:July 19, 2017 at 7:22 am
Posted in:Bad Sites, Exploits
Author:
Joseph C Chen (Fraud Researcher)

We’ve uncovered a new exploit kit in the wild through a malvertising campaign we’ve dubbed “ProMediads”. We call this new exploit kit Sundown-Pirate, as it’s indeed a bootleg of its precursors and actually named so by its back panel.

ProMediads has been active as early as 2016, employing Rig and Sundown exploit kits to deliver malware. Its activities dropped off in mid-February this year, but suddenly welled on June 16 via Rig. However, we noticed that ProMediads eschewed Rig in favor of Sundown-Pirate on June 25.

It’s worth noting that Sundown-Pirate is only employed by ProMediads so far. This could mean that it’s yet another private exploit kit, like the similarly styled GreenFlash Sundown exploit kit that was exclusively used by the ShadowGate campaign.

Posted on:June 20, 2017 at 7:28 am
Posted in:Bad Sites, Ransomware
Author:
Joseph C Chen (Fraud Researcher)

At the end of April this year, we found Astrum exploit kit employing Diffie-Hellman key exchange to prevent monitoring tools and researchers from replaying their traffic. As AdGholas started to push the exploit, we saw another evolution: Astrum using HTTPS to further obscure their malicious traffic. We spotted a new AdGholas malvertising campaign using the…

Posted on:May 18, 2017 at 7:40 am
Posted in:Exploits, Vulnerabilities
Author:
Joseph C Chen (Fraud Researcher)

The decline of exploit kit activity—particularly from well-known exploit kits like Magnitude, Nuclear, Neutrino, and Rig during the latter half of 2016—doesn’t mean exploit kits are throwing in the towel just yet. This is the case with Astrum (also known as Stagano), an old and seemingly reticent exploit kit we observed to have been updated multiple times as of late.

Astrum’s recent activities feature several upgrades and shows how it’s starting to move away from the more established malware mentioned above. It appears these changes were done to lay the groundwork for future campaigns, and possibly to broaden its use. With a modus operandi that deters analysis and forensics by abusing the Diffie-Hellman key exchange, it appears Astrum is throwing down the gauntlet.

Posted on:December 29, 2016 at 12:01 am
Posted in:Exploits, Malware, Vulnerabilities
Author:
Brooks Li and Joseph C. Chen (Threats Analysts)

This year has seen a big shift in the exploit kit landscape, with many of the bigger players unexpectedly dropping out of action. The Nuclear exploit kit operations started dwindling in May, Angler disappeared around the same time Russia’s Federal Security Service made nearly 50 arrests last June, and then in September Neutrino reportedly went private and shifted focus to select clientele only. Now, the most prominent exploit kits in circulation are RIG and Sundown. Both gained prominence shortly after Neutrino dropped out of active circulation.

Page 1 of 612 › »

New Disdain Exploit Kit Detected in the Wild

ProMediads Malvertising and Sundown-Pirate Exploit Kit Combo Drops Ransomware and Info Stealer

AdGholas Malvertising Campaign Employs Astrum Exploit Kit

Will Astrum Fill the Vacuum in the Exploit Kit Landscape?

Updated Sundown Exploit Kit Uses Steganography

Security Predictions for 2018

Business Process Compromise

Stay Updated

New Disdain Exploit Kit Detected in the Wild

ProMediads Malvertising and Sundown-Pirate Exploit Kit Combo Drops Ransomware and Info Stealer

AdGholas Malvertising Campaign Employs Astrum Exploit Kit

Will Astrum Fill the Vacuum in the Exploit Kit Landscape?

Updated Sundown Exploit Kit Uses Steganography

Security Predictions for 2018

Business Process Compromise

Popular Posts

Stay Updated