RIG exploit kit strikes oil

(Publication) Google search: [1]

RIG exploit kit strikes oil
Botnet	Cryptowall
Malware
Botnet/malware group
Exploit kits	RIG
Services
Feature
Distribution vector
Target
Origin
Campaign
Operation/Working group
Vulnerability
CCProtocol
Date	2014 / 2014
Editor/Conference	CISCO
Link	https://blogs.cisco.com/security/rig-exploit-kit-strikes-oil. blogs.cisco.com (blogs.cisco.com Archive copy)
Author	Andrew Tsonchev, Levi Gundert, Emmanuel Tacheau, Joel Esler
Type	Blogpost

Abstract

“ In the last month we have observed high levels of traffic consistent with the new “RIG” exploit kit (EK), as identified by Kahu Security. This new EK reportedly began being advertised on criminal forums in April, which coincides with when we first began blocking this traffic on April 24th. Whilst the release of a new EK is not uncommon, RIG’s appearance is significant in three ways. First, because of the sheer amount of traffic we are seeing -- we have so far blocked requests to over 90 domains for more than 17% of our Cloud Web Security (CWS) customers. Second, because we have seen it being used to distribute “Cryptowall”, the latest ransomware to follow in the success of the now infamous “Cryptolocker”. And third, because it continues the trend of an increased reliance upon Silverlight in EKs which we have previously written about for both the Fiesta and Angler kits. Like these other kits, we have seen RIG using malvertising to perform a drive-by attack on visitors to high profile, legitimate websites. This accounts for the high amount of traffic we have seen in the last month.

Bibtex

 @misc{2014BFR1387,
   editor = {CISCO},
   author = {Andrew Tsonchev, Levi Gundert, Emmanuel Tacheau, Joel Esler},
   title = {RIG exploit kit strikes oil},
   date = {08},
   month = May,
   year = {2014},
   howpublished = {\url{https://blogs.cisco.com/security/rig-exploit-kit-strikes-oil. blogs.cisco.com}},
 }