Campaign Evolution: EITest from October through December 2016
Unit 42 details the EITest campaign's late-2016 changes: gates and obfuscation dropped, with Rig EK variants delivering ransomware and infostealers.
Unit 42 tracks the EITest campaign through late 2016, noting it abandoned the gate between compromised websites and exploit kit landing pages after its October 2016 report, and stopped obfuscating injected script URLs by October 15. The campaign primarily uses the Rig-E (Empire Pack) variant and sometimes Rig-V of Rig EK to deliver Cerber and CryptoMix ransomware plus infostealers such as Gootkit, the Chthonic banking Trojan, Ursnif variants, and Latentbot. Tracked since 2014 by Malwarebytes Labs and others, EITest targets unpatched Windows systems without specific victimology.
- EITest dropped its traffic gate and script obfuscation in October 2016
- Primarily uses Rig-E (Empire Pack); Rig-V delivers Cerber and CryptoMix ransomware
- Also distributes Gootkit, Chthonic, Ursnif, and Latentbot stealers and banking Trojans
- Campaign active since 2014, showing exploit kits remain profitable for criminals
- Vendors
- Palo Alto Networks
- Products
- AutoFocus
- Threat actors
- EITest
- Organizations
- Malwarebytes LabsPalo Alto Networks
From the original article
4 min read at unit42.paloaltonetworks.com
EITest is a name originally coined by Malwarebytes Labs in 2014 to describe a campaign that uses exploit kits (EKs) to deliver malware. Until early January 2016, "EITest" was used as a variable name in the attacker’s malicious injected script in pages on legitimate websites compromised by this campaign.
By Brad Duncan · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.