Forest Global Training Partners

Cyber Risks · Cisco Talos

Threat Spotlight: Cisco Talos Thwarts Access to Massive International Exploit Kit Generating $60M Annually From Ransomware Alone

Summary: Cisco Talos reported that a single threat actor behind roughly half of Angler Exploit Kit activity was targeting up to 90,000 victims a day and generating more than $30 million annually from ransomware alone, implying total Angler revenue could exceed $60 million a year. Talos found much of Angler's proxy infrastructure hosted at Limestone Networks, and described an architecture of one exploit server fronted by multiple proxies plus a health monitoring server that checked hosts and remotely erased log files after fetching them.

Bottom line: One health server was observed monitoring 147 proxy servers over a month and pulling in more than $3 million, which shows the exploit kit's revenue was concentrated enough to be tracked and valued per server. That scale of ransomware income is the budget your defenses are actually up against.

Read the original at Cisco Talos ↗

Topics
Threat Actors & Nation-State
Related