Threat Spotlight: Exploit Kit Goes International Hits 150+ Countries
Summary: Cisco Talos traced the Nuclear exploit kit to activity targeting users in more than 10,000 cities across more than 150 countries, with nearly all tracked hosting on DigitalOcean, which validated the malicious hosts and worked with Talos on the takedown. A single server saw roughly 60,000 unique IPs connect in one day, almost half redirected from one adult webcam ad, and about 80 percent of the exploits leveraged Adobe Flash vulnerabilities, with most payloads being ransomware variants.
What's compelling: One porn-site ad redirected more than 25,000 IPs to the kit in a single day, and 65 percent of those users ran Internet Explorer 11 on Windows 7 or 8 - a reminder that the exploit surface is set by the browsers and plugins your fleet still allows, not by the sophistication of the kit.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026