Malware

Rig exploit kit

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Aug 17, 2026 · last 29d ago

Timeline2 articles

CryptoBit: Another Ransomware Family Gets an Update

Palo Alto Unit 42 analyzes updated CryptoBit ransomware distributed via the Rig exploit kit, documenting IOCs, eight sample hashes, and disguise tactics from June 2016.

Unit 42 observed an updated CryptoBit ransomware variant (also tracked as CriptoBit or Mobef) delivered through the Rig exploit kit via the gate domain realstatistics.info between June 17-27, 2016. Infections targeted Windows hosts with out-of-date Flash plugins, and post-infection callbacks used fake user-agents and referrers to disguise traffic to laoismacau.com. At least eight samples were collected, and by June 27 the campaign had begun distributing other malware.

Palo Alto Unit 42Aug 17, 09:48 UTC · 29d agoRansomware in the wild

Decline in Rig Exploit Kit

Rig exploit kit activity dropped roughly 75% after the pseudo-Darkleech and EITest campaigns stopped using EKs, reflecting an overall decline in exploit kit activity.

Rig EK activity fell sharply in 2017: the pseudo-Darkleech campaign disappeared at the end of March, cutting Rig traffic about 50%, and the EITest campaign switched to tech support scams in late April, cutting another 50% in May. Broader causes include a shrinking browser target base, no major EK zero-day in over a year, and community takedowns of domain shadowing infrastructure. Criminals are shifting to malspam, social engineering schemes like fake HoeflerText notifications, and tech support scams.

Palo Alto Unit 42Aug 17, 09:31 UTC · 29d agoExploit / PoC in the wild1

Appears with

threat actor EITest 1 threat actor pseudo-Darkleech 1 threat actor RoughTed 1 threat actor Seamless 1 malware CryptoBit 1 product Flash Player 1 vendor Cisco Talos 1 vendor Palo Alto Networks 1 vendor Panda Security 1 vendor Proofpoint 1 vendor RSA Research 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.