ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Malware

Neutrino exploit kit

0 mentions in 7 days · 1 in 30 days · 1 total · first seen · last

Search everything

Timeline

Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky

The Afraidgate exploit kit campaign stopped distributing CryptXXX and now delivers the .zepto Locky variant exclusively through Neutrino EK since July 2016.

By mid-July 2016, the Afraidgate campaign switched from CryptXXX ransomware to consistently delivering the .zepto (Zepto) variant of Locky, using the Neutrino exploit kit after Angler EK disappeared in early June 2016. The campaign starts from compromised websites with injected scripts that redirect to Afraidgate domains and then Neutrino EK landing pages on .top domains. Zepto emerged after the Necurs botnet returned from a three-week outage, bringing new anti-sandboxing and evasion techniques.

Palo Alto Unit 42 · 29d agoRansomware in the wild

Appears with

threat actor Afraidgate 1malware Angler exploit kit 1malware CryptXXX 1malware Locky 1malware Necurs botnet 1malware Zepto 1vendor Palo Alto Networks 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.