Ransomwarehigh
Bedep Lurking in Angler's Shadows
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-0310 | ASLR Protection-Mechanism Bypass in Adobe Flash Player | — | 15% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | dinorinwass.com | Talos dove deeper on two of these referrers in particular: dinorinwass[.]com/search.php wittalparuserigh[.]com Again, leveraging OpenD |
| domain | news4news14.com | tures. First, the syntax used was similar to the following: news4news14[.]com/?source=7-381898&campaign_id=2849 This syntax indicates i |
| domain | news4newsxxxx.com | referers that were using a group of domains that resembled news4newsXXXX.com where XXXX is some variant of year (i.e. 14, 15, 2014, 2015 |
| domain | wittalparuserigh.com | these referrers in particular: dinorinwass[.]com/search.php wittalparuserigh[.]com Again, leveraging OpenDNS, Talos was able to identify mor |
From the original article
10 min read at blog.talosintelligence.com
In October 2015, Talos released our detailed investigation of the Angler Exploit Kit which outlined the infrastructure and monetary impact of an exploit kit campaign delivering ransomware. During the investigation we found that two thirds of Angler's payloads were some variation of ransomware and noted one of the other major payloads was Bedep. Bedep is a malware downloader that is exclusive to Angler.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.