Angler Exploit Kit - New Variants
Summary: Cisco Talos researchers began observing a new Angler Exploit Kit campaign on January 27th using new variants tied to the Flash zero-day CVE-2015-0311, with the campaign running from January 26th to January 30th and most events on January 28th and 29th. The actors used layered subdomains to evade detection, with roughly 1,800 domains seen across the listed IP addresses and another ~650 subdomains linked to a single IP, 176.103.144.48, distributing exploits through malvertising that redirected through compromised sites to landing pages serving Adobe Flash and Silverlight exploits.
What you should know: Some of the new CVE-2015-0311 variants had detection rates as low as 1/57 to 3/57, so signature-based antivirus alone would have missed them while roughly 1,800 domains and a single IP fronted the campaign.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Mentions
- CVE-2015-0311
- Related
- The Latest Flash UAF Vulnerabilities in Exploit Kits Cyber Risks ·CVE-2015-0311: Adobe Flash Player Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Apr 13, 2022Flash 0-day Exploited by Angler Exploit Kit Cyber Risks ·