Domain Shadowing Goes Nuclear: A Story in Failed Sophistication
Summary: Cisco Talos found a Nuclear exploit kit campaign combining domain shadowing with HTTP 302 cushioning, techniques previously seen mainly in Angler, using shadowed subdomains such as mdfct6lfx8hccp56knyxlxj.sirabul.org and uncommon TLDs including .gq, .xyz, .tk and .ga. Talos reported the chain was largely failing: most users reaching the initial index.php were served blank files, HTTP 404 or 302 redirects, and the Flash exploit served three times failed all three, with one path ending in a browser-lock tech support scam directing users to a toll-free number.
Bottom line: The same layered obfuscation - base64-encoded referrer strings, domain shadowing and multiple redirect tiers - is what previously made Angler effective, and Talos notes it is now spreading to other kits; the failures here reflect an unfinished build, not a lack of capability.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026