30
45
45
30
30
30
How the EITest Campaign's Path to Angler EK Evolved Over Time
Unit 42 documents how the EITest campaign's gate URLs and infrastructure evolved since 2014 while still routing victims to Angler EK and diverse malware.
Unit 42 traced network traffic changes in the EITest campaign, which Malwarebytes identified in October 2014 across thousands of compromised websites. The campaign's injected script patterns have remained consistent, but its gate URLs changed repeatedly, and since January 2016 gates used the 85.93.0.0/24 IP block, often with .tk domains. The gate returns a Flash file that redirects victims to Angler EK, which delivered malware including Vawtrak, Tinba, TeslaCrypt, Bedep, Kovter, Ursnif, and Zeus variants from 2014 through 2016.
32
42
57
60
KRBanker Targets South Korea Through Adware and Exploit Kits
Unit 42 details KRBanker banking trojan targeting South Korean bank users via KaiXin exploit kit and NEWSPOT adware, using pharming and process hollowing.
KRBanker (aka Blackmoon) is a banking trojan targeting online banking users in the Republic of Korea, with roughly 2,000 unique samples and 200+ pharming servers observed by Unit 42 over six months. It is distributed through the KaiXin exploit kit exploiting Adobe Flash CVE-2014-0569 and CVE-2015-3133, and through the NEWSPOT adware update channel that also delivers the Venik trojan. The trojan uses process hollowing, retrieves pharming server IPs from Qzone profile nickname fields, and abuses Proxy Auto-Config with a local proxy to redirect banking traffic to forged sites.
42
EITest Campaign Evolution: From Angler EK to Neutrino and Rig
Unit 42 details the EITest campaign's shift from Angler to Neutrino and Rig exploit kits while distributing ransomware, downloaders, and banking trojans.
Unit 42 updated its tracking of the EITest campaign, first identified in October 2014, which compromises websites with injected scripts that redirect victims through a gate to exploit kits. After Angler EK disappeared in June 2016, EITest switched to Neutrino and then primarily used Rig EK by August 2016. In September 2016 the campaign began using hex-obfuscated JavaScript and simplified gate URLs, while continuing to distribute payloads including Gootkit, Cerber, Bart, CryptFile2, Vawtrak, Ursnif, and Tinba. Gate infrastructure consistently reused IP blocks such as 85.93.0.0/24 even as domain names changed.
36
Understanding Angler Exploit Kit
Unit 42 examines Angler EK operations, including rapid zero-day adoption, fileless Bedep infections, and ransomware payloads like TeslaCrypt and CryptXXX.
Unit 42 published the second part of its Angler EK analysis, covering the kit's history since 2013, its SaaS rental model, and its focus on Flash, Internet Explorer, and Silverlight exploits. Angler integrated the CVE-2015-5119 Flash zero-day from the Hacking Team leak within hours and later added exploits for CVE-2015-2419 and CVE-2016-0034 roughly a month after Microsoft patched them. Campaigns use Angler to deliver ransomware such as CryptoWall, TeslaCrypt, and CryptXXX, plus banking trojans and stealers via EITest. Since August 2014, Angler has used fileless, in-memory execution, most often for Bedep, which later downloads CryptXXX and click-fraud malware.
36
30
60
30
42
60
57
42
42
30
30
42
30
57
30
30
60
30
60
30