Evolution of the Nuclear Exploit Kit
Summary: Cisco Talos tracked a Nuclear exploit kit campaign that began in mid-August, peaked on September 18, and then rapidly declined, with malware hosted on 47 distinct IP addresses across 11 network providers. The kit served a heavily obfuscated JavaScript landing page that fingerprinted the visitor's browser, operating system, and plugin versions, then selected an exploit from its list, including CVE-2012-0507, and IP addresses typically hosted malware for no more than one day before being discarded.
Why it matters: The attackers settled on just two hosting providers for most of the campaign after nine were used in the first nine days, suggesting some providers moved faster than others to pull malware off their networks. A single unpatched browser plugin was enough to route a visitor from a legitimate site's ad to an exploit that downloaded and ran a payload.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026