Campaign Evolution: pseudo
Unit 42 traces the pseudo-Darkleech campaign's 2016 shift from Angler to Neutrino to Rig exploit kits and rotating ransomware payloads.
22
Threat actor
Pseudo-Darkleech
- Mentions · 7d0
- Mentions · 30d0
- All mentions5
- First seenAug 17, 2026
- Last mentionedAug 17, 2026
Timeline
5 articles · newest firstCampaign Evolution: Darkleech to Pseudo
Unit 42 traces the pseudo-Darkleech campaign, which compromises websites to inject scripts redirecting visitors to exploit kits delivering ransomware.
38
Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX
Unit 42 reports the Afraidgate campaign switched from Nuclear EK delivering Locky to Angler EK delivering CryptXXX via the Bedep downloader.
38
Understanding Angler Exploit Kit
Unit 42 examines Angler EK operations, including rapid zero-day adoption, fileless Bedep infections, and ransomware payloads like TeslaCrypt and CryptXXX.
36
Decline in Rig Exploit Kit
Rig exploit kit activity dropped roughly 75% after the pseudo-Darkleech and EITest campaigns stopped using EKs, reflecting an overall decline in exploit kit activity.
15
Related CVEs
by mentions- CVE-2016-003469%8.8Remote Code Execution via Crafted Website in Microsoft Silverlight 5
- CVE-2015-511999%—Use-After-Free RCE in Adobe Flash Player (ActionScript 3 ByteArray)
- CVE-2015-241953%—Memory Corruption RCE in Microsoft Internet Explorer JScript Engine
Appears with
- Palo Alto Networksvendor · 4
- Angler EKmalware · 3
- Unit 42organization · 3
- CryptXXXmalware · 3
- TeslaCryptmalware · 3
- CryptoWallmalware · 2
- EITestthreat actor · 2
- Bedepmalware · 2
- Sucurivendor · 1
- Darkleechthreat actor · 1
- Seamlessthreat actor · 1
- FreeDNSvendor · 1
- Trapsproduct · 1
- Adobe Flash Playerproduct · 1
- Cisco Talosvendor · 1
- Cerbermalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.