Campaign Evolution: pseudo
Unit 42 traces the pseudo-Darkleech campaign's 2016 shift from Angler to Neutrino to Rig exploit kits and rotating ransomware payloads.
Unit 42 documents how the pseudo-Darkleech exploit kit campaign evolved through 2016, switching from Angler EK to Neutrino EK in June and to Rig EK in September after Neutrino ceased operations. Payloads rotated from TeslaCrypt to CryptXXX, CrypMIC, and finally Cerber ransomware by October 2016. Injected script on compromised websites changed from 12,000-18,000 character obfuscated blocks to short, unobfuscated hidden iframes starting July 1, 2016.
22