Campaign Evolution: EITest from October through December 2016
Unit 42 details the EITest campaign's late-2016 changes: gates and obfuscation dropped, with Rig EK variants delivering ransomware and infostealers.
24
- Mentions · 7d0
- Mentions · 30d0
- All mentions5
- First seenAug 17, 2026
- Last mentionedAug 17, 2026
Timeline
5 articles · newest firstEITest Campaign Evolution: From Angler EK to Neutrino and Rig
Unit 42 details the EITest campaign's shift from Angler to Neutrino and Rig exploit kits while distributing ransomware, downloaders, and banking trojans.
36
How the EITest Campaign's Path to Angler EK Evolved Over Time
Unit 42 documents how the EITest campaign's gate URLs and infrastructure evolved since 2014 while still routing victims to Angler EK and diverse malware.
32
Understanding Angler Exploit Kit
Unit 42 examines Angler EK operations, including rapid zero-day adoption, fileless Bedep infections, and ransomware payloads like TeslaCrypt and CryptXXX.
36
Decline in Rig Exploit Kit
Rig exploit kit activity dropped roughly 75% after the pseudo-Darkleech and EITest campaigns stopped using EKs, reflecting an overall decline in exploit kit activity.
15
Related CVEs
by mentions- CVE-2016-003469%8.8Remote Code Execution via Crafted Website in Microsoft Silverlight 5
- CVE-2015-511999%—Use-After-Free RCE in Adobe Flash Player (ActionScript 3 ByteArray)
- CVE-2015-241953%—Memory Corruption RCE in Microsoft Internet Explorer JScript Engine
Appears with
- Palo Alto Networksvendor · 4
- Angler EKmalware · 3
- Ursnifmalware · 3
- Unit 42organization · 3
- Vawtrakmalware · 2
- TeslaCryptmalware · 2
- Bedepmalware · 2
- Rig EKmalware · 2
- Cerbermalware · 2
- Gootkitmalware · 2
- pseudo-Darkleechthreat actor · 2
- Adobe Flash Playerproduct · 2
- Tinbamalware · 2
- CryptFile2malware · 1
- Zeusmalware · 1
- Cisco Talosvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.