Angler

(Exploit kit) Link to the old Wiki page : [1]

Angler
Alias
Target
Origin
Group
Distribution vector
Language
Operation/Working group
BeginYear
EndYear
Status

Introduction

• Private variation of Cool Exploit Kit

Features

• Anti-virus blocking

• Virtual machine detection

• Debugging detection

CVE: CVE-2013-0074, CVE-2013-2551, CVE-2013-5329, CVE-2014-0322, CVE-2014-0497, CVE-2014-0515, CVE-2014-1776, CVE-2014-8439, CVE-2014-8440, CVE-2015-0310, CVE-2015-0311, CVE-2015-0313, CVE-2015-0336, CVE-2015-0359, CVE-2013-3896, CVE-2015-5122, CVE-2015-1671

Relations

• Campaigns:
• Distribution of: Bedep, CTB-Locker, CryptXXX, Reveton

Publications

	Author	Editor	Year
An overview of exploit packs	Mila Parkour	Contagio	2012
Angler Exploit Kit – Operating at the Cutting Edge	Abel Toro	Websense	2015
Blackhole and Cool Exploit kits nearly extinct	Dennis Fisher	Threatpost	2013
CVE-2015-0311 (Flash up to 16.0.0.287) integrating Exploit Kits	Kafeine	Malware don't need cofee	2015
Critroni crypto ransomware seen using Tor for command and control	Dennis Fisher	Kaspersky lab	2014
CryptXXX: new ransomware from the actors behind Reveton, dropping via Angler	Kafeine	Proofpoint	2016
Threat spotlight: Angler lurking in the domain shadows	Joel Esler Nick Biasini	CISCO	2015