ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Malware

Zeus

0 mentions in 7 days · 1 in 30 days · 1 total · first seen · last

Search everything

Timeline

How the EITest Campaign's Path to Angler EK Evolved Over Time

Unit 42 documents how the EITest campaign's gate URLs and infrastructure evolved since 2014 while still routing victims to Angler EK and diverse malware.

Unit 42 traced network traffic changes in the EITest campaign, which Malwarebytes identified in October 2014 across thousands of compromised websites. The campaign's injected script patterns have remained consistent, but its gate URLs changed repeatedly, and since January 2016 gates used the 85.93.0.0/24 IP block, often with .tk domains. The gate returns a Flash file that redirects victims to Angler EK, which delivered malware including Vawtrak, Tinba, TeslaCrypt, Bedep, Kovter, Ursnif, and Zeus variants from 2014 through 2016.

Palo Alto Unit 42 · 29d agoThreat actor in the wild

Appears with

threat actor EITest 1malware Angler EK 1malware Bedep 1malware Kovter 1malware TeslaCrypt 1malware Tinba 1malware Ursnif 1malware Vawtrak 1organization Unit 42 1product Adobe Flash Player 1vendor Malwarebytes 1vendor Palo Alto Networks 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.