Skip to content
NewA calmer, faster ZeroHour
RansomwarelowExploited in the wild

Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky

Palo Alto Unit 42by Brad Duncan ()3 min read2
Read at unit42.paloaltonetworks.com
AI summary · glm-5.3-flashSummaries by Vani AI

The Afraidgate exploit kit campaign stopped distributing CryptXXX and now delivers the .zepto Locky variant exclusively through Neutrino EK since July 2016.

By mid-July 2016, the Afraidgate campaign switched from CryptXXX ransomware to consistently delivering the .zepto (Zepto) variant of Locky, using the Neutrino exploit kit after Angler EK disappeared in early June 2016. The campaign starts from compromised websites with injected scripts that redirect to Afraidgate domains and then Neutrino EK landing pages on .top domains. Zepto emerged after the Necurs botnet returned from a three-week outage, bringing new anti-sandboxing and evasion techniques.

Key facts
  • Afraidgate last delivered CryptXXX on July 11, 2016, then switched to the .zepto Locky variant
  • Neutrino EK now distributes the majority of EK-based ransomware following Angler EK's disappearance
  • Zepto variant uses .zepto extension and adds anti-sandboxing and evasion techniques
  • IOCs include gate domains, .top Neutrino EK domains, and Locky post-infection C2 servers
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
ATT&CK
T1189 Drive-By CompromiseT1486 Data Encrypted for ImpactT1497.001 System Checks
Tags
afraidgateangler-ekcryptxxxexploit-kitlockyneutrino-ekransomwarezepto
Vendors
Palo Alto Networks
Threat actors
Afraidgate
Malware
LockyCryptXXXZeptoNeutrino exploit kitAngler exploit kitNecurs botnet

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
domainactivebeliever.comom - GET /rokmediaqueries.js 188.166.38.125 port 80 - siber.activebeliever[.]com - GET /plugins/fancybox-for-wordpress/js/jquery.easing.1.
domainatchisoncountyrecorder.com- GET /scripts/jquery.form.js 46.101.26.161 port 80 - motor.atchisoncountyrecorder[.]com - GET /js/blog.js 46.101.26.161 port 80 - motor.atchisonc
domainblautechnology.comom[.]br - GET /gantry-totop.js 46.101.26.161 port 80 - snow.blautechnology[.]com - GET /scripts/libs.js 46.101.26.161 port 80 - start.pute
domainbluechristian.toprdfngwg.blueelizabeth[.]top 185.140.33.99 port 80 - clfdkbl.bluechristian[.]top 185.140.33.99 port 80 - drhffhveq.greenjessica[.]top 185.
domainblueelizabeth.tophxmst.rautumngreen[.]top 185.140.33.99 port 80 - bkhrdfngwg.blueelizabeth[.]top 185.140.33.99 port 80 - clfdkbl.bluechristian[.]top 185.1
domainbsuperpink.toprt 80 - azbepfasz.yintored[.]top 5.2.72.236 port 80 - bkubf.bsuperpink[.]top 5.2.72.114 port 80 - iynwzttqd.hautumngreen[.]top 5.2.72.
domaingreenjessica.topfdkbl.bluechristian[.]top 185.140.33.99 port 80 - drhffhveq.greenjessica[.]top 185.140.33.99 port 80 - rklfdprel.blueelizabeth[.]top Loc
domainhautumngreen.top80 - bkubf.bsuperpink[.]top 5.2.72.114 port 80 - iynwzttqd.hautumngreen[.]top 5.2.72.236 port 80 - mxoug.yintored[.]top 5.2.72.236 port
domainladeratutors.com.]com - GET /js/addOnLoad.js 188.166.38.125 port 80 - nepal.laderatutors[.]com - GET /rokmediaqueries.js 188.166.38.125 port 80 - siber.
domainmafterred.topegoxmvzpx.bsuperpink[.]top 185.140.33.76 port 80 - erfxsnvj.mafterred[.]top 185.140.33.76 port 80 - hxmst.rautumngreen[.]top 185.140.
domainoautumnyellow.top- GET /to_top.js Neutrino EK: 5.2.72.236 port 80 - avukytj.oautumnyellow[.]top 5.2.72.236 port 80 - azbepfasz.yintored[.]top 5.2.72.236
domainonion.tostructions: mphtadhci5mrdlju.tor2web[.]org mphtadhci5mrdlju.onion[.]to zjfq4lnfbs7pncr5.tor2web[.]org zjfq4lnfbs7pncr5.onion[.]t
domainpolatoglumimarlik.comery.easing.1.3.min.js?ver=1.3 188.166.38.125 port 80 - zine.polatoglumimarlik[.]com - GET /scripts/jquery.sliderkit.1.9.2.pack.js 188.166.38.
domainputerasyawal.com[.]com - GET /scripts/libs.js 46.101.26.161 port 80 - start.puterasyawal[.]com - GET /js/addOnLoad.js 188.166.38.125 port 80 - nepal.lad
domainrautumngreen.top80 - erfxsnvj.mafterred[.]top 185.140.33.76 port 80 - hxmst.rautumngreen[.]top 185.140.33.99 port 80 - bkhrdfngwg.blueelizabeth[.]top 18
domainstmaryschooldmt.comhe Afraidgate campaign: Gates: 46.101.26.161 port 80 - leon.stmaryschooldmt[.]com - GET /scripts/jquery.form.js 46.101.26.161 port 80 - mot
domaintor2web.orgDomains from the decryption instructions: mphtadhci5mrdlju.tor2web[.]org mphtadhci5mrdlju.onion[.]to zjfq4lnfbs7pncr5.tor2web[.]or
domainyintored.topavukytj.oautumnyellow[.]top 5.2.72.236 port 80 - azbepfasz.yintored[.]top 5.2.72.236 port 80 - bkubf.bsuperpink[.]top 5.2.72.114 po
ipv4185.117.153.17650.135 port 80 - 185.5.250.135 - POST /upload/_dispatch.php 185.117.153.176 port 80 - 185.117.153.176 - POST /upload/_dispatch.php 185.
ipv4185.118.66.83.176 port 80 - 185.117.153.176 - POST /upload/_dispatch.php 185.118.66.83 port 80 - 185.118.66.83 - POST /upload/_dispatch.php Domain
ipv4185.140.33.76ored[.]top 5.2.72.236 port 80 - yegoxmvzpx.bsuperpink[.]top 185.140.33.76 port 80 - erfxsnvj.mafterred[.]top 185.140.33.76 port 80 -
ipv4185.140.33.99rred[.]top 185.140.33.76 port 80 - hxmst.rautumngreen[.]top 185.140.33.99 port 80 - bkhrdfngwg.blueelizabeth[.]top 185.140.33.99 port
ipv4185.5.250.13554.202 port 80 - 77.222.54.202 - POST /upload/_dispatch.php 185.5.250.135 port 80 - 185.5.250.135 - POST /upload/_dispatch.php 185.11
ipv4188.166.38.1251 port 80 - start.puterasyawal[.]com - GET /js/addOnLoad.js 188.166.38.125 port 80 - nepal.laderatutors[.]com - GET /rokmediaqueries.j
ipv446.101.26.161compromise associated with the Afraidgate campaign: Gates: 46.101.26.161 port 80 - leon.stmaryschooldmt[.]com - GET /scripts/jquery.
ipv45.187.0.137.253.173 port 80 - 5.9.253.173 - POST /upload/_dispatch.php 5.187.0.137 port 80 - 5.187.0.137 - POST /upload/_dispatch.php 77.222.5
ipv45.2.72.114.yintored[.]top 5.2.72.236 port 80 - bkubf.bsuperpink[.]top 5.2.72.114 port 80 - iynwzttqd.hautumngreen[.]top 5.2.72.236 port 80 -
ipv45.2.72.236zine.polatoglumimarlik[.]com - GET /to_top.js Neutrino EK: 5.2.72.236 port 80 - avukytj.oautumnyellow[.]top 5.2.72.236 port 80 -
ipv45.9.253.173rklfdprel.blueelizabeth[.]top Locky post-infection traffic: 5.9.253.173 port 80 - 5.9.253.173 - POST /upload/_dispatch.php 5.187.0.
ipv477.222.54.20287.0.137 port 80 - 5.187.0.137 - POST /upload/_dispatch.php 77.222.54.202 port 80 - 77.222.54.202 - POST /upload/_dispatch.php 185.5.

From the original article

3 min read at unit42.paloaltonetworks.com

By mid-July 2016, the Afraidgate campaign stopped distributing CryptXXX ransomware . It is now distributing the ". zepto" variant of Locky.

Palo Alto Unit 42

By Brad Duncan · unit42.paloaltonetworks.com

Read the full article at Palo Alto Unit 42

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.