Understanding Angler Exploit Kit
Unit 42 examines Angler EK operations, including rapid zero-day adoption, fileless Bedep infections, and ransomware payloads like TeslaCrypt and CryptXXX.
Unit 42 published the second part of its Angler EK analysis, covering the kit's history since 2013, its SaaS rental model, and its focus on Flash, Internet Explorer, and Silverlight exploits. Angler integrated the CVE-2015-5119 Flash zero-day from the Hacking Team leak within hours and later added exploits for CVE-2015-2419 and CVE-2016-0034 roughly a month after Microsoft patched them. Campaigns use Angler to deliver ransomware such as CryptoWall, TeslaCrypt, and CryptXXX, plus banking trojans and stealers via EITest. Since August 2014, Angler has used fileless, in-memory execution, most often for Bedep, which later downloads CryptXXX and click-fraud malware.
- Angler EK, discovered in 2013, is rented as a service for a few thousand dollars monthly and dominates observed EK traffic.
- Angler adopted the CVE-2015-5119 Flash zero-day from the Hacking Team dump within hours, before a patch existed.
- It integrated CVE-2015-2419 and CVE-2016-0034 exploits roughly a month after Microsoft patched them.
- Since August 2014, Angler uses fileless, memory-only execution, most associated with the Bedep downloader.
- Campaigns deliver ransomware like CryptoWall, TeslaCrypt, and CryptXXX, plus banking trojans and stealers via EITest.
- ATT&CK
- T1189 Drive-by CompromiseT1203 Exploitation for Client ExecutionT1105 Ingress Tool TransferT1486 Data Encrypted for ImpactT1620 Reflective Code Loading
- Threat actors
- Pseudo-DarkleechEITest
- Victims
- Hacking Team
- Organizations
- Unit 42
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-2419 | Memory Corruption RCE in Microsoft Internet Explorer JScript Engine | — | 53% | KEV | — KEV |
| CVE-2015-5119 | Use-After-Free RCE in Adobe Flash Player (ActionScript 3 ByteArray) | — | 99% | KEV | — KEV |
| CVE-2016-0034 | Remote Code Execution via Crafted Website in Microsoft Silverlight 5 | 8.8 | 69% | KEVRansomware | KEV |
From the original article
4 min read at unit42.paloaltonetworks.comThis is the second part of a two-part blog post for understanding Angler exploit kit (EK). The first part covered EKs in general. This blog focuses on the Angler EK.
By Brad Duncan · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.