RIG exploit kit strikes oil

From Botnets.fr
Jump to navigation Jump to search

(Publication) Google search: [1]

RIG exploit kit strikes oil
Botnet Cryptowall
Botnet/malware group
Exploit kits RIG
Distribution vector
Operation/Working group
Date 2014 / 2014
Editor/Conference CISCO
Link https://blogs.cisco.com/security/rig-exploit-kit-strikes-oil. blogs.cisco.com (blogs.cisco.com Archive copy)
Author Andrew Tsonchev, Levi Gundert, Emmanuel Tacheau, Joel Esler
Type Blogpost


In the last month we have observed high levels of traffic consistent with the new “RIG” exploit kit (EK), as identified by Kahu Security. This new EK reportedly began being advertised on criminal forums in April, which coincides with when we first began blocking this traffic on April 24th. Whilst the release of a new EK is not uncommon, RIG’s appearance is significant in three ways. First, because of the sheer amount of traffic we are seeing -- we have so far blocked requests to over 90 domains for more than 17% of our Cloud Web Security (CWS) customers. Second, because we have seen it being used to distribute “Cryptowall”, the latest ransomware to follow in the success of the now infamous “Cryptolocker”. And third, because it continues the trend of an increased reliance upon Silverlight in EKs which we have previously written about for both the Fiesta and Angler kits. Like these other kits, we have seen RIG using malvertising to perform a drive-by attack on visitors to high profile, legitimate websites. This accounts for the high amount of traffic we have seen in the last month.


 @misc{Lua error: Cannot create process: proc_open(/dev/null): failed to open stream: Operation not permitted2014BFR1387,
   editor = {CISCO},
   author = {Andrew Tsonchev, Levi Gundert, Emmanuel Tacheau, Joel Esler},
   title = {RIG exploit kit strikes oil},
   date = {19},
   month = Jun,
   year = {2014},
   howpublished = {\url{https://blogs.cisco.com/security/rig-exploit-kit-strikes-oil. blogs.cisco.com}},