Campaign Evolution: pseudo
Unit 42 traces the pseudo-Darkleech campaign's 2016 shift from Angler to Neutrino to Rig exploit kits and rotating ransomware payloads.
Unit 42 documents how the pseudo-Darkleech exploit kit campaign evolved through 2016, switching from Angler EK to Neutrino EK in June and to Rig EK in September after Neutrino ceased operations. Payloads rotated from TeslaCrypt to CryptXXX, CrypMIC, and finally Cerber ransomware by October 2016. Injected script on compromised websites changed from 12,000-18,000 character obfuscated blocks to short, unobfuscated hidden iframes starting July 1, 2016.
- Campaign switched exploit kits: Angler until June 2016, Neutrino until September, then Rig EK
- Ransomware payloads rotated through TeslaCrypt, CryptXXX, CrypMIC, and Cerber during 2016
- Injected script dropped heavy obfuscation in July 2016, becoming short unobfuscated iframes
- Infections follow a fixed chain: compromised sites redirect to EK landing pages exploiting outdated browsers
- Vendors
- Palo Alto Networks
- Threat actors
- pseudo-Darkleech
- Organizations
- Palo Alto Networks
From the original article
4 min read at unit42.paloaltonetworks.com
Darkleech is long-running campaign that uses exploit kits (EKs) to deliver malware. First identified in 2012, this campaign has used different EKs to distribute various types of malware during the past few years. We reviewed the most recent iteration of this campaign in March 2016 after it had settled into a pattern of distributing ransomware.
By Brad Duncan · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.