{"id":10401,"date":"2017-11-09T17:10:09","date_gmt":"2017-11-10T01:10:09","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/11\/09\/news-4174\/"},"modified":"2017-11-09T17:10:09","modified_gmt":"2017-11-10T01:10:09","slug":"news-4174","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2017\/11\/09\/news-4174\/","title":{"rendered":"Disdain exploit kit served with a side of social engineering"},"content":{"rendered":"

Credit to Author: J\u00e9r\u00f4me Segura| Date: Fri, 10 Nov 2017 00:23:26 +0000<\/strong><\/p>\n

Today we picked up new activity from an exploit kit that was first discovered<\/a> back in August of this year. The Disdain exploit kit, simply identified by a string of the same name found in its source code, is being distributed again after a short interruption via malvertising chains.<\/p>\n

Disdain EK relies on older vulnerabilities that have long been patched and some that do not appear to be working properly. From a traffic to infection point of view, this means that the conversion rates are going to be lower than, say, RIG EK, the other most common exploit kit at the moment.<\/p>\n

\"\"<\/a><\/p>\n

This may explain why we are seeing Disdain being used as a drive-by download alongside a social engineering attack to increase the likelihood of infections. Case in point, the following site was compromised to serve Disdain EK while also distributing a fake Flash Player update:<\/p>\n

\"\"<\/a><\/p>\n

What’s interesting is that both payloads (Disdain’s and the Flash update) are actually the same malware binary, just delivered by different methods. The former is loaded via an iframe<\/em> injected into the page, while the latter is a regular download that requires user interaction to execute it:<\/p>\n

\"\"<\/a><\/p>\n

Disdain’s landing page exploits older Internet Explorer vulnerabilities and attempts to load Flash exploits as well, although in our tests these did not work.<\/p>\n

\"\"<\/a><\/p>\n

The final payload, served either via the exploit or social engineering route, is Neutrino Bot<\/a>, which we have documented<\/a> on this blog before when it was served in malicious spam campaigns.<\/p>\n

In the past few weeks, there have been a few developments in the exploit kit scene beyond the long running RIG exploit kit, where threat actors are attempting new tricks both from an evasion and distribution point of view. Despite this, there remains a lack of innovation in what really matters at the end of the day: the exploits being used to deliver drive-by infections.<\/p>\n

While some groups<\/a> have switched to pure social engineering-based attacks, others are attempting either or both methods at once. In the current threat landscape, the campaigns that have the most success are those that can draw a lot of traffic and use clever techniques to fool users.<\/p>\n

Systems that have been patched regularly would not be affected by this exploit kit, but at the same time users should beware of non-legitimate software updates. Many of the so-called “Flash Player” or “Video Player” updates typically push adware and, as we saw recently with the BadRabbit<\/a> outbreak, even ransomware.<\/p>\n

Malwarebytes<\/a> users are protected from the Disdain exploit kit and Neutrino Bot malware.<\/p>\n

The post Disdain exploit kit served with a side of social engineering<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n

https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Credit to Author: J\u00e9r\u00f4me Segura| Date: Fri, 10 Nov 2017 00:23:26 +0000<\/strong><\/p>\n\n\n\n
<\/a><\/td>\n<\/tr>\n
Exploits may not be enough as threat actors combine them with social engineering in a new Disdain exploit kit attack method.<\/p>\n

Categories: <\/p>\n