Decline in Rig Exploit Kit
Rig exploit kit activity dropped roughly 75% after the pseudo-Darkleech and EITest campaigns stopped using EKs, reflecting an overall decline in exploit kit activity.
Rig EK activity fell sharply in 2017: the pseudo-Darkleech campaign disappeared at the end of March, cutting Rig traffic about 50%, and the EITest campaign switched to tech support scams in late April, cutting another 50% in May. Broader causes include a shrinking browser target base, no major EK zero-day in over a year, and community takedowns of domain shadowing infrastructure. Criminals are shifting to malspam, social engineering schemes like fake HoeflerText notifications, and tech support scams.
- Pseudo-Darkleech's disappearance in late March 2017 cut Rig EK traffic by about 50%
- EITest's April 2017 switch to tech support scams cut Rig activity another 50% in May
- Decline driven by shrinking IE/Edge target base, lack of new EK exploits, and domain shadowing takedowns
- Criminals increasingly use malspam, fake installers, and tech support scams for malware distribution
- Threat actors
- EITestpseudo-DarkleechRoughTedSeamless
- Malware
- Rig exploit kit
From the original article
5 min read at unit42.paloaltonetworks.com
Starting in April 2017, we saw a significant decrease in Rig exploit kit (EK) activity after two major campaigns, EITest and pseudo-Darkleech , stopped using EKs. Figure 1 shows the hits for the Rig EK from December 2016 through May 2017, highlighting this trend. This blog reviews recent developments in the EITest and pseudo-Darkleech campaigns that have contributed to the current drop in Rig EK.
By Brad Duncan · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.