Malware

Angler EK

0 mentions in 7 days · 6 in 30 days · 6 total · first seen Aug 17, 2026 · last 29d ago

Timeline6 articles

Campaign Evolution: Darkleech to Pseudo

Unit 42 traces the pseudo-Darkleech campaign, which compromises websites to inject scripts redirecting visitors to exploit kits delivering ransomware.

Palo Alto Networks Unit 42 analyzed the evolution of the pseudo-Darkleech campaign, which injects malicious script into compromised Apache, IIS and WordPress sites to redirect visitors to exploit kits such as Angler and Neutrino. The original Darkleech Apache module infected thousands of servers starting in 2012 and delivered Blackhole EK until that kit disappeared after Paunch's 2013 arrest. From 2015 onward, pseudo-Darkleech delivered ransomware families like CryptoWall and TeslaCrypt, and by early 2016 its injected scripts added obfuscated numeric blocks with frequently changing separator characters. Unit 42 tracks these patterns to help defenders identify compromised websites.

Palo Alto Unit 42Aug 17, 09:53 UTC · 29d agoThreat actor in the wild

EITest Campaign Evolution: From Angler EK to Neutrino and Rig

Unit 42 details the EITest campaign's shift from Angler to Neutrino and Rig exploit kits while distributing ransomware, downloaders, and banking trojans.

Unit 42 updated its tracking of the EITest campaign, first identified in October 2014, which compromises websites with injected scripts that redirect victims through a gate to exploit kits. After Angler EK disappeared in June 2016, EITest switched to Neutrino and then primarily used Rig EK by August 2016. In September 2016 the campaign began using hex-obfuscated JavaScript and simplified gate URLs, while continuing to distribute payloads including Gootkit, Cerber, Bart, CryptFile2, Vawtrak, Ursnif, and Tinba. Gate infrastructure consistently reused IP blocks such as 85.93.0.0/24 even as domain names changed.

Palo Alto Unit 42Aug 17, 09:52 UTC · 29d agoThreat actor in the wild

How the EITest Campaign's Path to Angler EK Evolved Over Time

Unit 42 documents how the EITest campaign's gate URLs and infrastructure evolved since 2014 while still routing victims to Angler EK and diverse malware.

Unit 42 traced network traffic changes in the EITest campaign, which Malwarebytes identified in October 2014 across thousands of compromised websites. The campaign's injected script patterns have remained consistent, but its gate URLs changed repeatedly, and since January 2016 gates used the 85.93.0.0/24 IP block, often with .tk domains. The gate returns a Flash file that redirects victims to Angler EK, which delivered malware including Vawtrak, Tinba, TeslaCrypt, Bedep, Kovter, Ursnif, and Zeus variants from 2014 through 2016.

Palo Alto Unit 42Aug 17, 09:51 UTC · 29d agoThreat actor in the wild

Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX

Unit 42 reports the Afraidgate campaign switched from Nuclear EK delivering Locky to Angler EK delivering CryptXXX via the Bedep downloader.

Unit 42 reported that the Afraidgate campaign, which uses gates registered through FreeDNS at afraid.org, switched in mid-April 2016 from Nuclear EK distributing Locky ransomware to Angler EK distributing CryptXXX. The Angler/Bedep/CryptXXX combination also spread from the pseudo-Darkleech campaign, with Bedep acting as a fileless, memory-resident downloader that also installs click-fraud malware. Recent Bedep updates detect virtual machines and alter behavior, complicating analyst investigation. Unit 42 published gate, EK, and post-infection indicators including gate IP 185.118.164.42 and associated domains.

Palo Alto Unit 42Aug 17, 09:51 UTC · 29d agoThreat actor in the wild

Understanding Angler Exploit Kit

Unit 42 explains exploit kit fundamentals, describing how landing pages profile victims, deliver exploits, and install malware payloads on Windows hosts.

Unit 42 published a primer on exploit kit fundamentals, defining vulnerabilities, exploits, malware payloads, actors, and campaigns in EK-based attacks. It explains the infection chain: a landing page profiles the victim's Windows system for vulnerable applications such as Flash Player, Java, Silverlight, and Internet Explorer, then a matching exploit executes a downloader or final payload, often delivered encrypted with XOR or RC4. The post also describes the EK-as-a-Service business model, in which leading EKs are rented for a few thousand dollars per month while buyers supply campaign infrastructure.

Palo Alto Unit 42Aug 17, 09:50 UTC · 29d agoResearch

Understanding Angler Exploit Kit

Unit 42 examines Angler EK operations, including rapid zero-day adoption, fileless Bedep infections, and ransomware payloads like TeslaCrypt and CryptXXX.

Unit 42 published the second part of its Angler EK analysis, covering the kit's history since 2013, its SaaS rental model, and its focus on Flash, Internet Explorer, and Silverlight exploits. Angler integrated the CVE-2015-5119 Flash zero-day from the Hacking Team leak within hours and later added exploits for CVE-2015-2419 and CVE-2016-0034 roughly a month after Microsoft patched them. Campaigns use Angler to deliver ransomware such as CryptoWall, TeslaCrypt, and CryptXXX, plus banking trojans and stealers via EITest. Since August 2014, Angler has used fileless, in-memory execution, most often for Bedep, which later downloads CryptXXX and click-fraud malware.

Palo Alto Unit 42Aug 17, 09:50 UTC · 29d agoResearch in the wildCVE-2015-5119 CVE-2015-2419 CVE-2016-0034

Related CVEsby mentions

CVE-2016-00348.870%
Remote Code Execution via Crafted Website in Microsoft Silverlight 5
CVE-2016-0034 is a memory-corruption flaw in the Microsoft Silverlight 5 runtime, which mishandles negative offsets during decoding, corrupting object headers. An attacker triggers it by convincing a user to visit a crafted website while the vulnerable Silverlight plug-in is active in their browser, requiring no privileges but user interaction. Successful exploitation allows the attacker to execute arbitrary code in the context of the logged-in user (or crash the browser/application). Anyone running Microsoft Silverlight 5 versions before 5.1.41212.0 is affected; Silverlight is now end-of-life, so remaining installations are legacy deployments. The flaw was exploited in the wild through exploit kits such as Angler and RIG to deliver ransomware like Cerber, and it was added to the CISA KEV catalog in May 2022 with known ransomware use.
· microsoft Silverlight Silverlight 5 before 5.1.41212.0 (fixed in 5.1.41212.0, January 2016 Patch Tuesday) KEV ransomwaremass
CVE-2015-5119—99%
Use-After-Free RCE in Adobe Flash Player (ActionScript 3 ByteArray)
CVE-2015-5119 is a use-after-free memory-corruption vulnerability (CWE-119) in the ActionScript 3 ByteArray class of Adobe Flash Player. It is triggered when Flash processes crafted ActionScript/SWF content — typically a malicious .swf loaded from a web page, advertisement, email attachment, or document — causing Flash to access already-freed memory in an attacker-controllable way. A successful attack gives the adversary remote code execution in the context of the user running Flash. Anyone with Adobe Flash Player installed was exposed; at disclosure Flash was on the vast majority of internet-connected desktops, and today risk is concentrated in legacy browsers, office/document tooling, industrial or enterprise applications, and other systems where Flash was never removed. Exploitation status: this flaw has long-standing in-the-wild use (related headlines tie the leaked Hacking Team Flash exploit to APT campaigns against Japanese, East Asian, and US Government targets and to top 2016 exploit kits), it is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03; ransomware use unknown), and EPSS assigns a 99.3% probability of exploitation within 30 days.
· Adobe Flash Player KEVmass
CVE-2015-2419—53%
Memory Corruption RCE in Microsoft Internet Explorer JScript Engine
CVE-2015-2419 is a memory corruption flaw (CWE-119) in the JScript engine used by Microsoft Internet Explorer, allowing remote attackers to execute arbitrary code or cause a denial of service through a crafted website. It is triggered when a user visits an attacker-controlled page whose JScript content corrupts memory in the affected browser process. A successful attacker gains remote code execution in the context of the logged-on user (or crashes the browser), which makes drive-by and exploit-kit delivery routes viable. Any Windows user running the affected versions of Internet Explorer at the time of disclosure was exposed, and Microsoft shipped fixes as part of its July 2015 security updates. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-28), carries a 53.4% EPSS (99th percentile), and related reporting places it among the top vulnerabilities used by exploit kits in 2015-2016.
· Microsoft Internet Explorer KEVmass

Appears with

organization Unit 42 6 vendor Palo Alto Networks 6 product Adobe Flash Player 3 threat actor EITest 3 threat actor Pseudo-Darkleech 3 malware CryptXXX 3 malware Bedep 3 malware TeslaCrypt 3 product Internet Explorer 2 product Microsoft Silverlight 2 malware CryptoWall 2 malware Ursnif 2 malware Rig EK 2 malware Neutrino EK 2 malware Tinba 2 malware Vawtrak 2

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.