Forest Global Training Partners

Cyber Risks · Cisco Talos

Angler EK: More Obfuscation, Fake Extensions, and Other Nonsense

Summary: Cisco Talos reported a sharp rise in Angler Exploit Kit activity, with landing-page URLs changed from a plain random string to the same string plus varied fake extensions such as .php, .play, .vbscript, .pycharm and .cppfile. The campaigns delivered Cryptowall and Bedep, used HTTP 302 cushioning and dynamic DNS instead of domain shadowing, and one Cryptowall sample contacted almost 40 domains and attempted to post data to 30 WordPress sites via the Revslider and WP All Import plugins.

What's compelling: Angler's authors changed the URL structure specifically to defeat detection that keys off landing-page paths, so signature and URL-pattern defenses tuned to the old format can miss the same exploit kit entirely. The Cryptowall sample's use of roughly 30 compromised WordPress sites on shared hosting also means IP blocklisting those servers would affect thousands of legitimate sites.

Read the original at Cisco Talos ↗

Topics
Malware
Related