{"id":6922,"date":"2017-03-09T13:10:13","date_gmt":"2017-03-09T21:10:13","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/03\/09\/news-713\/"},"modified":"2017-03-09T13:10:13","modified_gmt":"2017-03-09T21:10:13","slug":"news-713","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/03\/09\/news-713\/","title":{"rendered":"Exploit kits: Winter 2017 review"},"content":{"rendered":"<p><strong>Credit to Author: J\u00e9r\u00f4me Segura| Date: Thu, 09 Mar 2017 20:08:35 +0000<\/strong><\/p>\n<p><span id=\"more-16454\"><\/span>A few months have passed since our\u00a0<a href=\"https:\/\/blog.malwarebytes.com\/cybercrime\/exploits\/2016\/11\/exploit-kits-fall-2016-review\/\" target=\"_blank\">Fall 2016 review<\/a>\u00a0of the most common exploit kits we are seeing in our telemetry and honeypots. Today, we take another look at the current (bleak) EK scene by going over RIG, Sundown, Neutrino and Magnitude.<\/p>\n<p>There haven&#8217;t been any major changes in the past little while and exploit kit-related infections remain\u00a0low compared to those via malicious spam. This is in part due to the lack of fresh and <a href=\"http:\/\/malware.dontneedcoffee.com\/2017\/01\/CVE-2016-7200-7201.html\" target=\"_blank\">reliable<\/a> exploits in today&#8217;s drive-by landscape.<\/p>\n<p><a href=\"https:\/\/blog.sucuri.net\/2015\/12\/evolution-of-pseudo-darkleech.html\" target=\"_blank\">Pseudo-Darkleech<\/a> and <a href=\"https:\/\/blog.brillantit.com\/exposing-eitest-campaign\/\" target=\"_blank\">EITest<\/a> are the most popular redirection campaigns from compromised websites. They refer to code that is injected into &#8211; for the most part &#8211; <a href=\"https:\/\/blog.sucuri.net\/2017\/02\/rce-attempts-against-the-latest-wordpress-rest-api-vulnerability.html\" target=\"_blank\">WordPress<\/a>, <a href=\"https:\/\/www.joomla.org\/announcements\/release-news\/5678-joomla-3-6-4-released.html\" target=\"_blank\">Joomla<\/a>, or <a href=\"https:\/\/www.drupal.org\/psa-2016-001\" target=\"_blank\">Drupal<\/a> websites and\u00a0automatically redirects visitors to an\u00a0exploit kit landing page.<\/p>\n<p>Malvertising campaigns keep fuelling redirections to exploit kits as well, but can greatly vary in size and impact. The daily malverts from shady ad networks continue unchanged while the larger attacks going after top ad networks and publishers <a href=\"https:\/\/blog.malwarebytes.com\/cybercrime\/exploits\/2016\/12\/adgholas-malvertising-business-as-usual\/\" target=\"_blank\">come in waves<\/a>.<\/p>\n<p>In the following video, we do a quick overview of those exploit kits; if you are interested in the more technical details please scroll down for additional information on each of them.<\/p>\n<p> <iframe  src='https:\/\/www.youtube.com\/embed\/s0XmpsF4xAQ?version=3&#038;rel=0&#038;fs=1&#038;autohide=2&#038;showsearch=0&#038;showinfo=1&#038;iv_load_policy=1&#038;wmode=transparent' width=\"100%\" height=\"420\" frameborder=\"0\" ><\/iframe>  <\/p>\n<h3>Most used vulnerabilities<\/h3>\n<p><strong>Internet Explorer<\/strong><\/p>\n<ul>\n<li>CVE-2016-0189<\/li>\n<li>CVE-2014-6332<\/li>\n<li>CVE-2013-2551<\/li>\n<\/ul>\n<p><strong>Information disclosure<\/strong><\/p>\n<ul>\n<li>CVE-2016-3351<\/li>\n<li>CVE-2016-3298<\/li>\n<li>CVE-2016-0162<\/li>\n<\/ul>\n<p><strong>Edge<\/strong><\/p>\n<ul>\n<li>CVE-2016-7200<\/li>\n<li>CVE-2016-7201<\/li>\n<\/ul>\n<p><strong>Flash<\/strong><\/p>\n<ul>\n<li>CVE-2016-4117<\/li>\n<li>CVE-2016-1019<\/li>\n<li>CVE-2015-8651<\/li>\n<li>CVE-2015-7645<\/li>\n<\/ul>\n<p><strong>Silverlight<\/strong><\/p>\n<ul>\n<li>CVE-2016-0034<\/li>\n<\/ul>\n<h3>RIG EK<\/h3>\n<p>RIG EK remains the most popular\u00a0exploit kit at the moment used both in malvertising and compromised websites campaigns. Its primary payloads are ransomware (Cerber and CryptoShield).<\/p>\n<p>The landing page structure (URL and source code) hasn&#8217;t\u00a0really changed, but it is now using a pre-landing page to filter bots and other non-legitimate traffic.<\/p>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/RIG_EK.png\" data-rel=\"lightbox-0\" title=\"\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-16455 size-full\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/RIG_EK.png\" width=\"981\" height=\"89\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/RIG_EK.png 981w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/RIG_EK-300x27.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/RIG_EK-600x54.png 600w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/RIG_EK-965x89.png 965w\" sizes=\"auto, (max-width: 981px) 100vw, 981px\" \/><\/a><\/p>\n<p><em>Payload here: Dreambot<\/em><\/p>\n<h4>Gate (browser check)<\/h4>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/RIG_browser_check.png\" data-rel=\"lightbox-1\" title=\"\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-16456\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/RIG_browser_check.png\" alt=\"\" width=\"856\" height=\"391\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/RIG_browser_check.png 856w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/RIG_browser_check-300x137.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/RIG_browser_check-600x274.png 600w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/RIG_browser_check-767x349.png 767w\" sizes=\"auto, (max-width: 856px) 100vw, 856px\" \/><\/a><\/p>\n<h4>Landing page<\/h4>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/RIG_landing.png\" data-rel=\"lightbox-2\" title=\"\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-16457\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/RIG_landing.png\" alt=\"\" width=\"857\" height=\"390\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/RIG_landing.png 857w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/RIG_landing-300x137.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/RIG_landing-600x273.png 600w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/RIG_landing-767x349.png 767w\" sizes=\"auto, (max-width: 857px) 100vw, 857px\" \/><\/a><\/p>\n<h3>Sundown EK<\/h3>\n<p>Sundown EK keeps on changing its URL patterns, mainly\u00a0for the Flash exploit and its payload URLs. Sundown is a lot more quiet than RIG EK and for the most part contained to some\u00a0malvertising campaigns.<\/p>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Sundown_EK.png\" data-rel=\"lightbox-3\" title=\"\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-16458\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Sundown_EK.png\" alt=\"\" width=\"893\" height=\"91\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Sundown_EK.png 893w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Sundown_EK-300x31.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Sundown_EK-600x61.png 600w\" sizes=\"auto, (max-width: 893px) 100vw, 893px\" \/><\/a><\/p>\n<p><em>Payload here: VenusLocker<\/em><\/p>\n<h4>Landing page<\/h4>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Sundown_landing.png\" data-rel=\"lightbox-4\" title=\"\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-16459\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Sundown_landing.png\" alt=\"\" width=\"859\" height=\"392\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Sundown_landing.png 859w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Sundown_landing-300x137.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Sundown_landing-600x274.png 600w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Sundown_landing-767x349.png 767w\" sizes=\"auto, (max-width: 859px) 100vw, 859px\" \/><\/a><\/p>\n<h3>Neutrino EK<\/h3>\n<p>Neutrino EK seems to be the weapon of choice for special malvertising attacks that are difficult to reproduce. It features its usual pre-filtering gate that includes several checks against VMs and security software.<\/p>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Neutrino_EK.png\" data-rel=\"lightbox-5\" title=\"\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-16460\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Neutrino_EK.png\" alt=\"\" width=\"909\" height=\"155\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Neutrino_EK.png 909w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Neutrino_EK-300x51.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Neutrino_EK-600x102.png 600w\" sizes=\"auto, (max-width: 909px) 100vw, 909px\" \/><\/a><\/p>\n<p><em>Payload here: Neutrino bot<\/em><\/p>\n<h4>Filtering\u00a0gate (fingerprinting)<\/h4>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Neutrino_gate.png\" data-rel=\"lightbox-6\" title=\"\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-16461\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Neutrino_gate.png\" alt=\"\" width=\"857\" height=\"395\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Neutrino_gate.png 857w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Neutrino_gate-300x138.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Neutrino_gate-600x277.png 600w\" sizes=\"auto, (max-width: 857px) 100vw, 857px\" \/><\/a><\/p>\n<h4>Landing page<\/h4>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Neutrino_landing.png\" data-rel=\"lightbox-7\" title=\"\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-16462\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Neutrino_landing.png\" alt=\"\" width=\"854\" height=\"393\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Neutrino_landing.png 854w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Neutrino_landing-300x138.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Neutrino_landing-600x276.png 600w\" sizes=\"auto, (max-width: 854px) 100vw, 854px\" \/><\/a><\/p>\n<h3>Magnitude EK<\/h3>\n<p>Magnitude EK is a very geo-aware exploit kit being restricted to\u00a0Asia at the moment. It uses decoy finance or bitcoin websites with a special referer to lead to its gate.<\/p>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Magnitude_EK.png\" data-rel=\"lightbox-8\" title=\"\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-16464\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Magnitude_EK.png\" alt=\"\" width=\"982\" height=\"172\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Magnitude_EK.png 982w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Magnitude_EK-300x53.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Magnitude_EK-600x105.png 600w\" sizes=\"auto, (max-width: 982px) 100vw, 982px\" \/><\/a><\/p>\n<p><em>Payload here: Cerber<\/em><\/p>\n<h4>IE exploit<\/h4>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Magnitude_IE.png\" data-rel=\"lightbox-9\" title=\"\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-16465\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Magnitude_IE.png\" alt=\"\" width=\"857\" height=\"393\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Magnitude_IE.png 857w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Magnitude_IE-300x138.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Magnitude_IE-600x275.png 600w\" sizes=\"auto, (max-width: 857px) 100vw, 857px\" \/><\/a><\/p>\n<h4>Landing page<\/h4>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Magnitude_landing.png\" data-rel=\"lightbox-10\" title=\"\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-16466\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Magnitude_landing.png\" alt=\"\" width=\"857\" height=\"395\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Magnitude_landing.png 857w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Magnitude_landing-300x138.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/02\/Magnitude_landing-600x277.png 600w\" sizes=\"auto, (max-width: 857px) 100vw, 857px\" \/><\/a><\/p>\n<h3>Wrap up<\/h3>\n<p>There are more exploit kits\u00a0than just those mentioned in this blog, but some were not included because they were simply copycats or because we have only seen them very sporadically.<\/p>\n<p>Some EKs are indeed quite difficult to reproduce without a proper setup and some previous knowledge of the various traps affiliates and traffers are putting in the way. In other cases, they may fall off the radar until a new campaign (i.e. malvertising) is put in place.<\/p>\n<p>While there hasn&#8217;t been a big focus on getting newer exploits integrated, we can note that exploit kit authors are investing some time into better bot detection and evasion, essentially trying to optimize the leads they are getting.<\/p>\n<p>However, we should still be aware that this situation could change as new and powerful exploits can be discovered at any time and come with a ready-to-use proof of concept. For instance,\u00a0<span class=\"s1\"><a href=\"https:\/\/bugs.chromium.org\/p\/project-zero\/issues\/detail?id=1011\" target=\"_blank\">CVE-2017-0037<\/a>,\u00a0a vulnerability that affects IE and Edge, is something attackers are likely to integrate soon.<\/span><\/p>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2017\/03\/exploit-kits-winter-2017-review\/\">Exploit kits: Winter 2017 review<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2017\/03\/exploit-kits-winter-2017-review\/\" target=\"bwo\" >https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><strong>Credit to Author: J\u00e9r\u00f4me Segura| Date: Thu, 09 Mar 2017 20:08:35 +0000<\/strong><\/p>\n<table cellpadding='10'>\n<tr>\n<td valign='top' align='center'><a href='https:\/\/blog.malwarebytes.com\/threat-analysis\/2017\/03\/exploit-kits-winter-2017-review\/' title='Exploit kits: Winter 2017 review'><img src='https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2013\/12\/photodune-5376577-alert-message-l.jpg' border='0'  width='300px'  \/><\/a><\/td>\n<\/tr>\n<tr>\n<td valign='top' align='left'>We take a look at the current exploit kit scene (Winter 2017) according to our telemetry and honeypots.<\/p>\n<p>Categories: <\/p>\n<ul class=\"post-categories\">\n<li><a href=\"https:\/\/blog.malwarebytes.com\/category\/threat-analysis\/exploits-threat-analysis\/\" rel=\"category tag\">Exploits<\/a><\/li>\n<li><a href=\"https:\/\/blog.malwarebytes.com\/category\/threat-analysis\/\" rel=\"category tag\">Threat analysis<\/a><\/li>\n<\/ul>\n<p>Tags: <a href=\"https:\/\/blog.malwarebytes.com\/tag\/ek\/\" rel=\"tag\">EK<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/exploit-kits\/\" rel=\"tag\">exploit kits<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/magnitude\/\" rel=\"tag\">Magnitude<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/malvertising\/\" rel=\"tag\">malvertising<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/malverts\/\" rel=\"tag\">malverts<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/malware\/\" rel=\"tag\">malware<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/neutrino\/\" rel=\"tag\">neutrino<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/ransomware\/\" rel=\"tag\">ransomware<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/rig\/\" rel=\"tag\">RIG<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/sundown\/\" rel=\"tag\">sundown<\/a><\/p>\n<table width='100%'>\n<tr>\n<td align=right>\n<p><b>(<a href='https:\/\/blog.malwarebytes.com\/threat-analysis\/2017\/03\/exploit-kits-winter-2017-review\/' title='Exploit kits: Winter 2017 review'>Read more&#8230;<\/a>)<\/b><\/p>\n<\/td>\n<\/tr>\n<\/table>\n<\/td>\n<\/tr>\n<\/table>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2017\/03\/exploit-kits-winter-2017-review\/\">Exploit kits: Winter 2017 review<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10488,10378],"tags":[10527,10528,10987,7871,10531,11588,3764,11338,3765,11589,10535,10494],"class_list":["post-6922","post","type-post","status-publish","format-standard","hentry","category-malwarebytes","category-security","tag-ek","tag-exploit-kits","tag-exploits","tag-magnitude","tag-malvertising","tag-malverts","tag-malware","tag-neutrino","tag-ransomware","tag-rig","tag-sundown","tag-threat-analysis"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/6922","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=6922"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/6922\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=6922"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=6922"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=6922"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}