30
30
30
30
30
30
30
30
45
Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky
The Afraidgate exploit kit campaign stopped distributing CryptXXX and now delivers the .zepto Locky variant exclusively through Neutrino EK since July 2016.
By mid-July 2016, the Afraidgate campaign switched from CryptXXX ransomware to consistently delivering the .zepto (Zepto) variant of Locky, using the Neutrino exploit kit after Angler EK disappeared in early June 2016. The campaign starts from compromised websites with injected scripts that redirect to Afraidgate domains and then Neutrino EK landing pages on .top domains. Zepto emerged after the Necurs botnet returned from a three-week outage, bringing new anti-sandboxing and evasion techniques.
15
45
"Blank Slate" Campaign Takes Advantage of Hosting Providers to Spread Ransomware
Unit 42 profiles the Blank Slate malspam campaign: blank emails with double-zipped attachments delivering Cerber ransomware while cycling abused hosting provider domains.
The Blank Slate campaign sends empty emails containing double-zipped archives with macro-enabled Word documents or JavaScript files that launch PowerShell to download ransomware, primarily Cerber, and occasionally Sage 2.0 or Locky. Unit 42 observed 555 campaign domains over seven months, with actors repeatedly registering new domains and cycling abuse of legitimate hosting providers after takedowns. In a five-day January-February 2017 window, at least eight domains across seven IP addresses were observed hosting Cerber payloads.
26
30
30
45
Decline in Rig Exploit Kit
Rig exploit kit activity dropped roughly 75% after the pseudo-Darkleech and EITest campaigns stopped using EKs, reflecting an overall decline in exploit kit activity.
Rig EK activity fell sharply in 2017: the pseudo-Darkleech campaign disappeared at the end of March, cutting Rig traffic about 50%, and the EITest campaign switched to tech support scams in late April, cutting another 50% in May. Broader causes include a shrinking browser target base, no major EK zero-day in over a year, and community takedowns of domain shadowing infrastructure. Criminals are shifting to malspam, social engineering schemes like fake HoeflerText notifications, and tech support scams.
15
30
30
30
Upatre Continued to Evolve with new Anti
Unit 42 analyzes an undocumented Upatre downloader variant with VM detection via process hashing, packed code, disabled Windows defenses and Namecoin .bit C2 domains.
Unit 42 analyzed an Upatre downloader variant compiled in December 2016 that went largely undetected by automated systems, featuring heavy code flow obscuration, on-demand decryption of network communications, and novel virtual machine detection. The sample enumerates running processes, computes CRC32 hashes XORed with a hard-coded key, and sleeps if analysis-related processes such as vmtoolsd.exe or python.exe are found. It masquerades with Google Chrome icons, disables Windows Defender, Firewall and other security services, injects code into msiexec.exe, and resolves .bit Namecoin domains like bookreader[.]bit via hardcoded OpenNIC DNS servers over TCP.
28
30
30
Malspam Targeting Brazil Continues to Evolve
Brazilian malspam campaigns continue evolving, abusing Google URL shortener and Dropbox and using Squiblydoo plus DLL side-loading to deploy likely infostealing botnet malware.
A June 2017 Brazilian malspam campaign spoofed IPTU tax notification emails, using the recipient's address as the sender, and abused Google's URL shortener and Dropbox to deliver a zip containing a malicious Windows shortcut (.lnk) file. The LNK used the Squiblydoo technique (regsvr32.exe) to download and execute a scriptlet with elevated privileges, retrieving a signed G-Buster Browser Defense executable alongside a malicious fltLib.dll loaded via side-loading, likely an information-stealing botnet. Post-infection HTTP traffic exposed over 400 infected Windows hosts, mostly in Brazil, with 2,132 Banload-tagged samples observed in the first half of 2017.
20
30
35
Understanding Angler Exploit Kit
Unit 42 examines Angler EK operations, including rapid zero-day adoption, fileless Bedep infections, and ransomware payloads like TeslaCrypt and CryptXXX.
Unit 42 published the second part of its Angler EK analysis, covering the kit's history since 2013, its SaaS rental model, and its focus on Flash, Internet Explorer, and Silverlight exploits. Angler integrated the CVE-2015-5119 Flash zero-day from the Hacking Team leak within hours and later added exploits for CVE-2015-2419 and CVE-2016-0034 roughly a month after Microsoft patched them. Campaigns use Angler to deliver ransomware such as CryptoWall, TeslaCrypt, and CryptXXX, plus banking trojans and stealers via EITest. Since August 2014, Angler has used fileless, in-memory execution, most often for Bedep, which later downloads CryptXXX and click-fraud malware.
36
30
Campaign Evolution: Darkleech to Pseudo
Unit 42 traces the pseudo-Darkleech campaign, which compromises websites to inject scripts redirecting visitors to exploit kits delivering ransomware.
Palo Alto Networks Unit 42 analyzed the evolution of the pseudo-Darkleech campaign, which injects malicious script into compromised Apache, IIS and WordPress sites to redirect visitors to exploit kits such as Angler and Neutrino. The original Darkleech Apache module infected thousands of servers starting in 2012 and delivered Blackhole EK until that kit disappeared after Paunch's 2013 arrest. From 2015 onward, pseudo-Darkleech delivered ransomware families like CryptoWall and TeslaCrypt, and by early 2016 its injected scripts added obfuscated numeric blocks with frequently changing separator characters. Unit 42 tracks these patterns to help defenders identify compromised websites.
38
30
30
45
45
30
30
30