How the EITest Campaign's Path to Angler EK Evolved Over Time
Unit 42 documents how the EITest campaign's gate URLs and infrastructure evolved since 2014 while still routing victims to Angler EK and diverse malware.
Unit 42 traced network traffic changes in the EITest campaign, which Malwarebytes identified in October 2014 across thousands of compromised websites. The campaign's injected script patterns have remained consistent, but its gate URLs changed repeatedly, and since January 2016 gates used the 85.93.0.0/24 IP block, often with .tk domains. The gate returns a Flash file that redirects victims to Angler EK, which delivered malware including Vawtrak, Tinba, TeslaCrypt, Bedep, Kovter, Ursnif, and Zeus variants from 2014 through 2016.
- EITest injected script patterns have stayed largely static since September 2014, with only URLs and variable names changing.
- Since January 2016, EITest gates consistently used the 85.93.0.0/24 IP block, most often with .tk domains.
- The gate returns a Flash file redirecting victims to Angler EK, which delivered TeslaCrypt, Vawtrak, Tinba, Bedep, and Ursnif variants.
- Unlike ransomware-focused Angler campaigns, EITest pushed a wide variety of malware families.
- ATT&CK
- T1189 Drive-by CompromiseT1203 Exploitation for Client ExecutionT1486 Data Encrypted for Impact
- Products
- Adobe Flash Player
- Threat actors
- EITest
- Organizations
- Unit 42
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | aba98.com | 85.93.0[.]33 - mvcvideo[.]tk 2016-03-14: 85.93.0[.]33 - bab.aba98[.]com 2016-03-29: 85.93.0[.]34 - folesd[.]tk When we first noti |
| domain | bobibo.tk | 85.93.0[.]32 - feedero[.]tk 2016-01-25: 85.93.0[.]32 - www.bobibo[.]tk 2016-01-26: 85.93.0[.]32 - en.robertkuzma[.]com 2016-02-0 |
| domain | dofned.tk | 2-03: 85.93.0[.]32 - vyetbr[.]tk 2016-02-10: 85.93.0[.]32 - dofned[.]tk 2016-02-15: 85.93.0[.]32 - zeboms[.]tk 2016-02-18: 85.93. |
| domain | feedero.tk | 31.184.192[.]206 - vecexeze[.]tk 2016-01-19: 85.93.0[.]32 - feedero[.]tk 2016-01-25: 85.93.0[.]32 - www.bobibo[.]tk 2016-01-26: 85 |
| domain | fix-mo.tk | 6 - flv.79highstreet.co[.]uk 2014-10-02: 148.251.56[.]156 - fix-mo[.]tk 2015-06-08: 194.15.126[.]7 - joans[.]ga 2015-11-10: 31.18 |
| domain | folesd.tk | : 85.93.0[.]33 - bab.aba98[.]com 2016-03-29: 85.93.0[.]34 - folesd[.]tk When we first noticed the EITest gate in September 2014, |
| domain | joans.ga | 148.251.56[.]156 - fix-mo[.]tk 2015-06-08: 194.15.126[.]7 - joans[.]ga 2015-11-10: 31.184.192[.]206 - ymest[.]ml 2015-12-04: 31. |
| domain | mvcvideo.tk | 3-07: 85.93.0[.]33 - nixsys[.]tk 2016-03-09: 85.93.0[.]33 - mvcvideo[.]tk 2016-03-14: 85.93.0[.]33 - bab.aba98[.]com 2016-03-29: 85 |
| domain | nixsys.tk | 3-04: 85.93.0[.]33 - vovevy[.]tk 2016-03-07: 85.93.0[.]33 - nixsys[.]tk 2016-03-09: 85.93.0[.]33 - mvcvideo[.]tk 2016-03-14: 85.9 |
| domain | robertkuzma.com | 5.93.0[.]32 - www.bobibo[.]tk 2016-01-26: 85.93.0[.]32 - en.robertkuzma[.]com 2016-02-03: 85.93.0[.]32 - vyetbr[.]tk 2016-02-10: 85.93. |
| domain | syte4.com | : 85.93.0[.]32 - zeboms[.]tk 2016-02-18: 85.93.0[.]32 - 14s.syte4[.]com 2016-03-04: 85.93.0[.]33 - vovevy[.]tk 2016-03-07: 85.93. |
| domain | vecexeze.tk | 1.184.192[.]206 - ymest[.]ml 2015-12-04: 31.184.192[.]206 - vecexeze[.]tk 2016-01-19: 85.93.0[.]32 - feedero[.]tk 2016-01-25: 85.93 |
| domain | vovevy.tk | : 85.93.0[.]32 - 14s.syte4[.]com 2016-03-04: 85.93.0[.]33 - vovevy[.]tk 2016-03-07: 85.93.0[.]33 - nixsys[.]tk 2016-03-09: 85.93. |
| domain | vyetbr.tk | 93.0[.]32 - en.robertkuzma[.]com 2016-02-03: 85.93.0[.]32 - vyetbr[.]tk 2016-02-10: 85.93.0[.]32 - dofned[.]tk 2016-02-15: 85.93. |
| domain | ymest.ml | 194.15.126[.]7 - joans[.]ga 2015-11-10: 31.184.192[.]206 - ymest[.]ml 2015-12-04: 31.184.192[.]206 - vecexeze[.]tk 2016-01-19: |
| domain | zeboms.tk | 2-10: 85.93.0[.]32 - dofned[.]tk 2016-02-15: 85.93.0[.]32 - zeboms[.]tk 2016-02-18: 85.93.0[.]32 - 14s.syte4[.]com 2016-03-04: 85 |
| ipv4 | 148.251.56.156 | and domain we have seen for the EITest gate URL 2014-09-22: 148.251.56[.]156 - flv.79highstreet.co[.]uk 2014-10-02: 148.251.56[.]156 - |
| ipv4 | 194.15.126.7 | .]uk 2014-10-02: 148.251.56[.]156 - fix-mo[.]tk 2015-06-08: 194.15.126[.]7 - joans[.]ga 2015-11-10: 31.184.192[.]206 - ymest[.]ml 20 |
| ipv4 | 31.184.192.206 | mo[.]tk 2015-06-08: 194.15.126[.]7 - joans[.]ga 2015-11-10: 31.184.192[.]206 - ymest[.]ml 2015-12-04: 31.184.192[.]206 - vecexeze[.]tk |
| ipv4 | 85.93.0.32 | ml 2015-12-04: 31.184.192[.]206 - vecexeze[.]tk 2016-01-19: 85.93.0[.]32 - feedero[.]tk 2016-01-25: 85.93.0[.]32 - www.bobibo[.]tk |
| ipv4 | 85.93.0.33 | .]tk 2016-02-18: 85.93.0[.]32 - 14s.syte4[.]com 2016-03-04: 85.93.0[.]33 - vovevy[.]tk 2016-03-07: 85.93.0[.]33 - nixsys[.]tk 2016 |
| ipv4 | 85.93.0.34 | .]tk 2016-03-14: 85.93.0[.]33 - bab.aba98[.]com 2016-03-29: 85.93.0[.]34 - folesd[.]tk When we first noticed the EITest gate in Se |
From the original article
3 min read at unit42.paloaltonetworks.comIn October 2014, Malwarebytes identified a campaign based on thousands of compromised websites that kicked off an infection chain to Angler exploit kit (EK). It was named "EITest" campaign, because "EITest" was a variable consistently found in injected scripts across all of the compromised websites. Malwarebytes noted some changes in this campaign in 2015 and 2016 .
By Brad Duncan · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.