Eric.freyssinet: 1 revision imported

2015-02-07T14:30:33Z

1 revision imported

← Older revision		Revision as of 14:30, 7 February 2015
(No difference)

Eric.freyssinet at 14:04, 6 June 2014

2014-06-06T14:04:26Z

New page

{{Publication
|Type=Blogpost
|Link=https://blogs.cisco.com/security/rig-exploit-kit-strikes-oil. blogs.cisco.com
|Author=Andrew Tsonchev, Levi Gundert, Emmanuel Tacheau, Joel Esler
|NomRevue=CISCO Blog
|Date=2014
|Editor=CISCO
|Year=2014
|Botnet=Cryptowall
|ExploitKit=RIG
|Abstract=In the last month we have observed high levels of traffic consistent with the new “RIG” exploit kit (EK), as identified by Kahu Security. This new EK reportedly began being advertised on criminal forums in April, which coincides with when we first began blocking this traffic on April 24th. Whilst the release of a new EK is not uncommon, RIG’s appearance is significant in three ways. First, because of the sheer amount of traffic we are seeing -- we have so far blocked requests to over 90 domains for more than 17% of our Cloud Web Security (CWS) customers. Second, because we have seen it being used to distribute “Cryptowall”, the latest ransomware to follow in the success of the now infamous “Cryptolocker”. And third, because it continues the trend of an increased reliance upon Silverlight in EKs which we have previously written about for both the Fiesta and Angler kits. Like these other kits, we have seen RIG using malvertising to perform a drive-by attack on visitors to high profile, legitimate websites. This accounts for the high amount of traffic we have seen in the last month.
}}

RIG exploit kit strikes oil - Revision history

Eric.freyssinet: 1 revision imported

Eric.freyssinet at 14:04, 6 June 2014