Take the RIG Pill: Down the Rabbit Hole
Summary: Cisco Talos reports that the RIG exploit kit, seeking to fill the gap left by Angler's disappearance, uses EITest-style gates on compromised sites to push victims through a chain of redirects to an obfuscated landing page. That page hides one Base64-encoded VBScript and two Base64-encoded JavaScript files in variables named (s); all three download the same final payload, including Gamarue and CRYPTFILE2, while exploiting different vulnerabilities such as CVE-2013-2551.
Key Takeaway: URLs, filenames and embedded comments are individualized per victim and session, so detection keyed to URLs or document names will miss the same infection on the next host. The payload is XOR-encoded with a password carried in the script and written and executed twice, once via control.exe, giving defenders a second execution path to account for.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026