Campaign Evolution: EITest from October through December 2016
Unit 42 details the EITest campaign's late-2016 changes: gates and obfuscation dropped, with Rig EK variants delivering ransomware and infostealers.
24
Malware
Rig EK
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenAug 17, 2026
- Last mentionedAug 17, 2026
Timeline
3 articles · newest firstCampaign Evolution: Darkleech to Pseudo
Unit 42 traces the pseudo-Darkleech campaign, which compromises websites to inject scripts redirecting visitors to exploit kits delivering ransomware.
38
EITest Campaign Evolution: From Angler EK to Neutrino and Rig
Unit 42 details the EITest campaign's shift from Angler to Neutrino and Rig exploit kits while distributing ransomware, downloaders, and banking trojans.
36
Appears with
- Palo Alto Networksvendor · 3
- Neutrino EKmalware · 2
- Gootkitmalware · 2
- Unit 42organization · 2
- Ursnifmalware · 2
- EITestthreat actor · 2
- Cerbermalware · 2
- Angler EKmalware · 2
- Sucurivendor · 1
- CryptoMixmalware · 1
- Empire Packmalware · 1
- CryptFile2malware · 1
- Darkleechthreat actor · 1
- WordPressproduct · 1
- Vawtrakmalware · 1
- Bartmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.