ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Angler exploit kit”

108 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllRansomware 42Vulnerability 22Malware 14Threat actor 12Exploit / PoC 7Data breach 5Policy & legal 3Research 2Phishing & fraud 1
SeverityAllcritical 24high 52medium 21low 10info 1

Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX

Unit 42 reports the Afraidgate campaign switched from Nuclear EK delivering Locky to Angler EK delivering CryptXXX via the Bedep downloader.

Unit 42 reported that the Afraidgate campaign, which uses gates registered through FreeDNS at afraid.org, switched in mid-April 2016 from Nuclear EK distributing Locky ransomware to Angler EK distributing CryptXXX. The Angler/Bedep/CryptXXX combination also spread from the pseudo-Darkleech campaign, with Bedep acting as a fileless, memory-resident downloader that also installs click-fraud malware. Recent Bedep updates detect virtual machines and alter behavior, complicating analyst investigation. Unit 42 published gate, EK, and post-infection indicators including gate IP 185.118.164.42 and associated domains.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wild

Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky

The Afraidgate exploit kit campaign stopped distributing CryptXXX and now delivers the .zepto Locky variant exclusively through Neutrino EK since July 2016.

By mid-July 2016, the Afraidgate campaign switched from CryptXXX ransomware to consistently delivering the .zepto (Zepto) variant of Locky, using the Neutrino exploit kit after Angler EK disappeared in early June 2016. The campaign starts from compromised websites with injected scripts that redirect to Afraidgate domains and then Neutrino EK landing pages on .top domains. Zepto emerged after the Necurs botnet returned from a three-week outage, bringing new anti-sandboxing and evasion techniques.

Palo Alto Unit 42 · Aug 17, 2026Ransomware in the wild

Campaign Evolution: Darkleech to Pseudo

Unit 42 traces the pseudo-Darkleech campaign, which compromises websites to inject scripts redirecting visitors to exploit kits delivering ransomware.

Palo Alto Networks Unit 42 analyzed the evolution of the pseudo-Darkleech campaign, which injects malicious script into compromised Apache, IIS and WordPress sites to redirect visitors to exploit kits such as Angler and Neutrino. The original Darkleech Apache module infected thousands of servers starting in 2012 and delivered Blackhole EK until that kit disappeared after Paunch's 2013 arrest. From 2015 onward, pseudo-Darkleech delivered ransomware families like CryptoWall and TeslaCrypt, and by early 2016 its injected scripts added obfuscated numeric blocks with frequently changing separator characters. Unit 42 tracks these patterns to help defenders identify compromised websites.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wild

Decline in Rig Exploit Kit

Rig exploit kit activity dropped roughly 75% after the pseudo-Darkleech and EITest campaigns stopped using EKs, reflecting an overall decline in exploit kit activity.

Rig EK activity fell sharply in 2017: the pseudo-Darkleech campaign disappeared at the end of March, cutting Rig traffic about 50%, and the EITest campaign switched to tech support scams in late April, cutting another 50% in May. Broader causes include a shrinking browser target base, no major EK zero-day in over a year, and community takedowns of domain shadowing infrastructure. Criminals are shifting to malspam, social engineering schemes like fake HoeflerText notifications, and tech support scams.

Palo Alto Unit 42 · Aug 17, 2026Exploit / PoC in the wild1