Threat Spotlight: Sundown Matures
Summary: Cisco Talos reports that the Sundown exploit kit has stripped the easy identifiers from its infection chain, added new exploits, and replaced its base64 's' variables with random strings, hexadecimal character encoding, and Lorem Ipsum comments to hinder analysis. Talos also tied the campaign to bulk purchases of expiring domains through reseller auctions, using registrant accounts under the name 'Stivie Malone' and the address stiviemalone@gmail[.]com, with one transfer of at least 500 domains completed in a couple of days after the new year.
What's compelling: The actor sought domains at least six months old and priced between $0.10 and $0.60, paid in bitcoin, specifically to defeat screening that blocks newly registered domains - and Sundown throws its full arsenal of IE and Flash exploits at each victim rather than a single attempt.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Mentions
- CVE-2016-0189
- Related
- CVE-2016-0189: Microsoft Internet Explorer Memory Corruption Vulnerability Known Exploited Vulnerabilities · Mar 28, 2022The Old and New: Current Trends in Web-based Threats Cyber Risks ·