Ransomwarecritical
Welcome Spelevo: New exploit kit full of old tricks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-15982 | Use-After-Free in Adobe Flash Player Allows Arbitrary Code Execution | 7.8 | 90% | KEVRansomwarePoC | KEV |
| CVE-2018-8174 | Out-of-Bounds Write RCE in Microsoft Windows VBScript Engine | 7.5 | 88% | KEVRansomwarePoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 54.armlessdance.top | .]top diary[.]motoribyron[.]top bologna[.]vediocorset[.]top 54[.]armlessdance[.]top perv[.]armlessdance[.]top homosexual[.]armlessdance[.]t |
| domain | absolutely.caballerosricky.top | chantelle[.]periodherstory[.]top tes[.]teannapostales[.]top absolutely[.]caballerosricky[.]top pete[.]clothedcalcutta[.]top foley[.]clothedcalcutta[.] |
| domain | abu.fightingsatan.top | mbustion[.]denizprivatne[.]top talent[.]denudaskalani[.]top abu[.]fightingsatan[.]top anziane[.]fightingsatan[.]top world[.]italyalemanes[.]t |
| domain | adina.teasingfreehome.top | g[.]leilanihardcord[.]top powerpuff[.]mancicdreadlock[.]top adina[.]teasingfreehome[.]top animay[.]tranniefotologs[.]top qwerty[.]virusemoticonos |
| domain | adora.dailysexpress.top | top emule[.]unicornbrune[.]top candye[.]brunetbebitas[.]top adora[.]dailysexpress[.]top famose[.]dailysexpress[.]top trailery[.]dailysexpress[. |
| domain | ameuter.carmellanightelf.top | tic[.]bridgettepromise[.]top socal[.]carmellanightelf[.]top ameuter[.]carmellanightelf[.]top high[.]cartoonseverinin[.]top sample[.]cartoonseverinin |
| domain | animay.tranniefotologs.top | rpuff[.]mancicdreadlock[.]top adina[.]teasingfreehome[.]top animay[.]tranniefotologs[.]top qwerty[.]virusemoticonos[.]top erotic[.]bridgettepromis |
| domain | anziane.fightingsatan.top | ]top talent[.]denudaskalani[.]top abu[.]fightingsatan[.]top anziane[.]fightingsatan[.]top world[.]italyalemanes[.]top converted[.]minorikeibler[. |
| domain | arnold.cosbyfunnies.top | .]top katsumi[.]carmanexteme[.]top bww[.]cosbyfunnies[.]top arnold[.]cosbyfunnies[.]top vodeos[.]galeriebeths[.]top veronica[.]galeriebeths[.]t |
| domain | asturias.freakylanguage.top | re[.]bloggerlolicon[.]top filmmaking[.]bloggerlolicon[.]top asturias[.]freakylanguage[.]top delco[.]graffitoandnot[.]top tanto[.]ingyenesrusian[.]t |
| domain | bailey.gratuitekrystal.top | tural[.]fantasygisselle[.]top copii[.]gratuitekrystal[.]top bailey[.]gratuitekrystal[.]top dating[.]leilanihardcord[.]top powerpuff[.]mancicdreadl |
| domain | beastyality.minorikeibler.top | world[.]italyalemanes[.]top converted[.]minorikeibler[.]top beastyality[.]minorikeibler[.]top gore[.]natachafetish[.]top binary[.]playingactive[.]top |
| domain | binary.playingactive.top | eastyality[.]minorikeibler[.]top gore[.]natachafetish[.]top binary[.]playingactive[.]top tes[.]satanicenanos[.]top window[.]aphroditedrink[.]top |
| domain | bologna.vediocorset.top | op swallowing[.]flavorideal[.]top diary[.]motoribyron[.]top bologna[.]vediocorset[.]top 54[.]armlessdance[.]top perv[.]armlessdance[.]top homos |
| domain | book.emblemliterotica.top | le[.]cartoonseverinin[.]top groups[.]chabertcigarette[.]top book[.]emblemliterotica[.]top diary[.]ghanaiansorority[.]top taylors[.]ghanaiansorori |
| domain | break.periodherstory.top | tanto[.]ingyenesrusian[.]top punker[.]militarymagyar[.]top break[.]periodherstory[.]top chantelle[.]periodherstory[.]top tes[.]teannapostales[. |
| domain | breitny.barbiereallity.top | top tes[.]satanicenanos[.]top window[.]aphroditedrink[.]top breitny[.]barbiereallity[.]top dyre[.]bloggerlolicon[.]top filmmaking[.]bloggerlolicon |
| domain | bww.cosbyfunnies.top | charmane[.]belarusapple[.]top katsumi[.]carmanexteme[.]top bww[.]cosbyfunnies[.]top arnold[.]cosbyfunnies[.]top vodeos[.]galeriebeths[.]top |
| domain | calientes.nylontruth.top | [.]top hailey[.]nylonsneak[.]top goddess[.]nylontruth[.]top calientes[.]nylontruth[.]top clasica[.]santarough[.]top famili[.]clearnubile[.]top c |
| domain | candye.brunetbebitas.top | .]top marge[.]sandeerugrat[.]top emule[.]unicornbrune[.]top candye[.]brunetbebitas[.]top adora[.]dailysexpress[.]top famose[.]dailysexpress[.]to |
| domain | chaild.denizprivatne.top | railery[.]dailysexpress[.]top mulatas[.]damitahustler[.]top chaild[.]denizprivatne[.]top combustion[.]denizprivatne[.]top talent[.]denudaskalani |
| domain | chantelle.periodherstory.top | punker[.]militarymagyar[.]top break[.]periodherstory[.]top chantelle[.]periodherstory[.]top tes[.]teannapostales[.]top absolutely[.]caballerosricky |
| domain | charmane.belarusapple.top | op different[.]beestkilroys[.]top race[.]belarusapple[.]top charmane[.]belarusapple[.]top katsumi[.]carmanexteme[.]top bww[.]cosbyfunnies[.]top a |
| domain | clara.awesomeablam.top | p perv[.]armlessdance[.]top homosexual[.]armlessdance[.]top clara[.]awesomeablam[.]top different[.]beestkilroys[.]top race[.]belarusapple[.]to |
| domain | clasica.santarough.top | top goddess[.]nylontruth[.]top calientes[.]nylontruth[.]top clasica[.]santarough[.]top famili[.]clearnubile[.]top colombia[.]clearnubile[.]top |
| domain | colombia.clearnubile.top | .]top clasica[.]santarough[.]top famili[.]clearnubile[.]top colombia[.]clearnubile[.]top swallowing[.]flavorideal[.]top diary[.]motoribyron[.]to |
| domain | combustion.denizprivatne.top | mulatas[.]damitahustler[.]top chaild[.]denizprivatne[.]top combustion[.]denizprivatne[.]top talent[.]denudaskalani[.]top abu[.]fightingsatan[.]top |
| domain | converted.minorikeibler.top | p anziane[.]fightingsatan[.]top world[.]italyalemanes[.]top converted[.]minorikeibler[.]top beastyality[.]minorikeibler[.]top gore[.]natachafetish[ |
| domain | copii.gratuitekrystal.top | ley[.]clothedcalcutta[.]top natural[.]fantasygisselle[.]top copii[.]gratuitekrystal[.]top bailey[.]gratuitekrystal[.]top dating[.]leilanihardcord |
| domain | dating.leilanihardcord.top | opii[.]gratuitekrystal[.]top bailey[.]gratuitekrystal[.]top dating[.]leilanihardcord[.]top powerpuff[.]mancicdreadlock[.]top adina[.]teasingfreeho |
| domain | delco.graffitoandnot.top | king[.]bloggerlolicon[.]top asturias[.]freakylanguage[.]top delco[.]graffitoandnot[.]top tanto[.]ingyenesrusian[.]top punker[.]militarymagyar[.] |
| domain | diary.ghanaiansorority.top | oups[.]chabertcigarette[.]top book[.]emblemliterotica[.]top diary[.]ghanaiansorority[.]top taylors[.]ghanaiansorority[.]top spit[.]natashayoungste |
| domain | diary.motoribyron.top | colombia[.]clearnubile[.]top swallowing[.]flavorideal[.]top diary[.]motoribyron[.]top bologna[.]vediocorset[.]top 54[.]armlessdance[.]top per |
| domain | different.beestkilroys.top | homosexual[.]armlessdance[.]top clara[.]awesomeablam[.]top different[.]beestkilroys[.]top race[.]belarusapple[.]top charmane[.]belarusapple[.]top |
| domain | dyre.bloggerlolicon.top | indow[.]aphroditedrink[.]top breitny[.]barbiereallity[.]top dyre[.]bloggerlolicon[.]top filmmaking[.]bloggerlolicon[.]top asturias[.]freakylang |
| domain | emule.unicornbrune.top | r[.]top the[.]sandeerugrat[.]top marge[.]sandeerugrat[.]top emule[.]unicornbrune[.]top candye[.]brunetbebitas[.]top adora[.]dailysexpress[.]to |
| domain | erotic.bridgettepromise.top | imay[.]tranniefotologs[.]top qwerty[.]virusemoticonos[.]top erotic[.]bridgettepromise[.]top socal[.]carmellanightelf[.]top ameuter[.]carmellanighte |
| domain | ezylifebags.com.au | he system. In this case, the actual gate is being hosted at ezylifebags[.]com[.]au with a 302 cushion. As you can see, this isn't the only |
| domain | famili.clearnubile.top | top calientes[.]nylontruth[.]top clasica[.]santarough[.]top famili[.]clearnubile[.]top colombia[.]clearnubile[.]top swallowing[.]flavorideal[. |
| domain | famose.dailysexpress.top | op candye[.]brunetbebitas[.]top adora[.]dailysexpress[.]top famose[.]dailysexpress[.]top trailery[.]dailysexpress[.]top mulatas[.]damitahustler[ |
| domain | filmmaking.bloggerlolicon.top | breitny[.]barbiereallity[.]top dyre[.]bloggerlolicon[.]top filmmaking[.]bloggerlolicon[.]top asturias[.]freakylanguage[.]top delco[.]graffitoandnot[ |
| domain | foley.clothedcalcutta.top | lutely[.]caballerosricky[.]top pete[.]clothedcalcutta[.]top foley[.]clothedcalcutta[.]top natural[.]fantasygisselle[.]top copii[.]gratuitekrystal |
| domain | get.guerradanger.top | eronica[.]galeriebeths[.]top lithuania[.]galeriebeths[.]top get[.]guerradanger[.]top name[.]preitymutter[.]top the[.]sandeerugrat[.]top marg |
| domain | goddess.nylontruth.top | Domains: open[.]nylonsneak[.]top hailey[.]nylonsneak[.]top goddess[.]nylontruth[.]top calientes[.]nylontruth[.]top clasica[.]santarough[.]top |
| domain | gore.natachafetish.top | ted[.]minorikeibler[.]top beastyality[.]minorikeibler[.]top gore[.]natachafetish[.]top binary[.]playingactive[.]top tes[.]satanicenanos[.]top |
| domain | groups.chabertcigarette.top | gh[.]cartoonseverinin[.]top sample[.]cartoonseverinin[.]top groups[.]chabertcigarette[.]top book[.]emblemliterotica[.]top diary[.]ghanaiansorority[ |
| domain | hailey.nylonsneak.top | . INDICATORS OF COMPROMISE Domains: open[.]nylonsneak[.]top hailey[.]nylonsneak[.]top goddess[.]nylontruth[.]top calientes[.]nylontruth[.]top |
| domain | high.cartoonseverinin.top | l[.]carmellanightelf[.]top ameuter[.]carmellanightelf[.]top high[.]cartoonseverinin[.]top sample[.]cartoonseverinin[.]top groups[.]chabertcigaret |
| domain | homosexual.armlessdance.top | set[.]top 54[.]armlessdance[.]top perv[.]armlessdance[.]top homosexual[.]armlessdance[.]top clara[.]awesomeablam[.]top different[.]beestkilroys[.]t |
| domain | katsumi.carmanexteme.top | top race[.]belarusapple[.]top charmane[.]belarusapple[.]top katsumi[.]carmanexteme[.]top bww[.]cosbyfunnies[.]top arnold[.]cosbyfunnies[.]top vo |
| domain | lithuania.galeriebeths.top | p vodeos[.]galeriebeths[.]top veronica[.]galeriebeths[.]top lithuania[.]galeriebeths[.]top get[.]guerradanger[.]top name[.]preitymutter[.]top the[ |
| domain | marge.sandeerugrat.top | er[.]top name[.]preitymutter[.]top the[.]sandeerugrat[.]top marge[.]sandeerugrat[.]top emule[.]unicornbrune[.]top candye[.]brunetbebitas[.]top |
| domain | mulatas.damitahustler.top | famose[.]dailysexpress[.]top trailery[.]dailysexpress[.]top mulatas[.]damitahustler[.]top chaild[.]denizprivatne[.]top combustion[.]denizprivatne |
| domain | name.preitymutter.top | top lithuania[.]galeriebeths[.]top get[.]guerradanger[.]top name[.]preitymutter[.]top the[.]sandeerugrat[.]top marge[.]sandeerugrat[.]top emu |
| domain | natural.fantasygisselle.top | pete[.]clothedcalcutta[.]top foley[.]clothedcalcutta[.]top natural[.]fantasygisselle[.]top copii[.]gratuitekrystal[.]top bailey[.]gratuitekrystal[ |
| domain | open.nylonsneak.top | r purchase on Snort.org . INDICATORS OF COMPROMISE Domains: open[.]nylonsneak[.]top hailey[.]nylonsneak[.]top goddess[.]nylontruth[.]top ca |
| domain | perv.armlessdance.top | n[.]top bologna[.]vediocorset[.]top 54[.]armlessdance[.]top perv[.]armlessdance[.]top homosexual[.]armlessdance[.]top clara[.]awesomeablam[.] |
| domain | pete.clothedcalcutta.top | s[.]teannapostales[.]top absolutely[.]caballerosricky[.]top pete[.]clothedcalcutta[.]top foley[.]clothedcalcutta[.]top natural[.]fantasygisselle |
| domain | powerpuff.mancicdreadlock.top | iley[.]gratuitekrystal[.]top dating[.]leilanihardcord[.]top powerpuff[.]mancicdreadlock[.]top adina[.]teasingfreehome[.]top animay[.]tranniefotologs[ |
| domain | punker.militarymagyar.top | p delco[.]graffitoandnot[.]top tanto[.]ingyenesrusian[.]top punker[.]militarymagyar[.]top break[.]periodherstory[.]top chantelle[.]periodherstory |
| domain | qwerty.virusemoticonos.top | dina[.]teasingfreehome[.]top animay[.]tranniefotologs[.]top qwerty[.]virusemoticonos[.]top erotic[.]bridgettepromise[.]top socal[.]carmellanightel |
| domain | race.belarusapple.top | p clara[.]awesomeablam[.]top different[.]beestkilroys[.]top race[.]belarusapple[.]top charmane[.]belarusapple[.]top katsumi[.]carmanexteme[.] |
| domain | sample.cartoonseverinin.top | uter[.]carmellanightelf[.]top high[.]cartoonseverinin[.]top sample[.]cartoonseverinin[.]top groups[.]chabertcigarette[.]top book[.]emblemliterotica |
| domain | socal.carmellanightelf.top | rty[.]virusemoticonos[.]top erotic[.]bridgettepromise[.]top socal[.]carmellanightelf[.]top ameuter[.]carmellanightelf[.]top high[.]cartoonseverini |
| domain | spit.natashayoungster.top | y[.]ghanaiansorority[.]top taylors[.]ghanaiansorority[.]top spit[.]natashayoungster[.]top IPs: 95.211.5[.]242 |
| domain | swallowing.flavorideal.top | top famili[.]clearnubile[.]top colombia[.]clearnubile[.]top swallowing[.]flavorideal[.]top diary[.]motoribyron[.]top bologna[.]vediocorset[.]top 5 |
| domain | talent.denudaskalani.top | aild[.]denizprivatne[.]top combustion[.]denizprivatne[.]top talent[.]denudaskalani[.]top abu[.]fightingsatan[.]top anziane[.]fightingsatan[.]top |
| domain | tanto.ingyenesrusian.top | sturias[.]freakylanguage[.]top delco[.]graffitoandnot[.]top tanto[.]ingyenesrusian[.]top punker[.]militarymagyar[.]top break[.]periodherstory[.] |
| domain | taylors.ghanaiansorority.top | ook[.]emblemliterotica[.]top diary[.]ghanaiansorority[.]top taylors[.]ghanaiansorority[.]top spit[.]natashayoungster[.]top IPs: 95.211.5[.]242 |
| domain | tes.satanicenanos.top | top gore[.]natachafetish[.]top binary[.]playingactive[.]top tes[.]satanicenanos[.]top window[.]aphroditedrink[.]top breitny[.]barbiereallity[ |
| domain | tes.teannapostales.top | eak[.]periodherstory[.]top chantelle[.]periodherstory[.]top tes[.]teannapostales[.]top absolutely[.]caballerosricky[.]top pete[.]clothedcalcut |
| domain | the.sandeerugrat.top | hs[.]top get[.]guerradanger[.]top name[.]preitymutter[.]top the[.]sandeerugrat[.]top marge[.]sandeerugrat[.]top emule[.]unicornbrune[.]top c |
| domain | trailery.dailysexpress.top | op adora[.]dailysexpress[.]top famose[.]dailysexpress[.]top trailery[.]dailysexpress[.]top mulatas[.]damitahustler[.]top chaild[.]denizprivatne[.] |
| domain | veronica.galeriebeths.top | top arnold[.]cosbyfunnies[.]top vodeos[.]galeriebeths[.]top veronica[.]galeriebeths[.]top lithuania[.]galeriebeths[.]top get[.]guerradanger[.]top |
| domain | vodeos.galeriebeths.top | [.]top bww[.]cosbyfunnies[.]top arnold[.]cosbyfunnies[.]top vodeos[.]galeriebeths[.]top veronica[.]galeriebeths[.]top lithuania[.]galeriebeths[ |
| domain | window.aphroditedrink.top | ]top binary[.]playingactive[.]top tes[.]satanicenanos[.]top window[.]aphroditedrink[.]top breitny[.]barbiereallity[.]top dyre[.]bloggerlolicon[.] |
| domain | world.italyalemanes.top | top abu[.]fightingsatan[.]top anziane[.]fightingsatan[.]top world[.]italyalemanes[.]top converted[.]minorikeibler[.]top beastyality[.]minorikei |
| domain | your-prizes-box.life | also a request for another JavaScript file being hosted at your-prizes-box[.]life. However, this request doesn't result in anything but add |
| ipv4 | 95.211.5.242 | .]ghanaiansorority[.]top spit[.]natashayoungster[.]top IPs: 95.211.5[.]242 |
From the original article
9 min read at blog.talosintelligence.com
Exploit kits are an ever-present and often forgotten threat on the landscape today. Their popularity seemed to peak several years ago with the success and eventual downfall of some of the best compromise platforms ever created, including the Angler Exploit Kit . These kits generated millions of dollars from their victims and they are still effective.
By Nick Biasini · blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.