Rigging compromise - RIG Exploit Kit
Summary: Cisco Talos traced the RIG exploit kit, first seen in its telemetry in November 2013 as Goon, to 44 IP addresses, all but one in ASN 35415 associated with Webzilla and leased to Eurobyte, both Russian providers. Using domain shadowing with over 7,000 subdomains and more than 60 unique referers over two months, RIG delivered payloads via a separate GET request and dropped files named to mimic Windows services like defsrag.exe and systemrestore.exe into TEMP folders.
What's compelling: Webzilla blocked the reported hosts, but Eurobyte did not respond to multiple emails and new servers kept appearing, so Talos and OpenDNS blocklisted five suspect subnets for 30 days - a reminder that takedown depends on the smallest downstream provider, not the one with the abuse desk.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026