Understanding Angler Exploit Kit
Unit 42 explains exploit kit fundamentals, describing how landing pages profile victims, deliver exploits, and install malware payloads on Windows hosts.
Unit 42 published a primer on exploit kit fundamentals, defining vulnerabilities, exploits, malware payloads, actors, and campaigns in EK-based attacks. It explains the infection chain: a landing page profiles the victim's Windows system for vulnerable applications such as Flash Player, Java, Silverlight, and Internet Explorer, then a matching exploit executes a downloader or final payload, often delivered encrypted with XOR or RC4. The post also describes the EK-as-a-Service business model, in which leading EKs are rented for a few thousand dollars per month while buyers supply campaign infrastructure.
- Exploit kits chain compromised websites, gates, landing pages, exploits, and encrypted payloads into drive-by infections without user action.
- Landing pages profile victims for vulnerable Flash, Java, Silverlight, and browser versions before selecting an exploit.
- Leading EKs operate under an as-a-service model rented for thousands of dollars monthly, with buyers supplying campaign infrastructure.
- Payloads are typically downloaders or final malware, delivered encrypted with XOR or RC4 and executed in memory.
- ATT&CK
- T1189 Drive-by CompromiseT1203 Exploitation for Client ExecutionT1105 Ingress Tool TransferT1027 Obfuscated Files or Information
- Organizations
- Unit 42
From the original article
7 min read at unit42.paloaltonetworks.comGenerally speaking, criminal groups use two methods for widespread distribution of malware. The most common method is malicious spam (malspam). This is a fairly direct mechanism, usually through an email attachment or a link in the message to the malware.
By Brad Duncan · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.