The never ending Exploit Kit shift - Bleeding Life

Summary: Cisco Talos reported that the Bleeding Life exploit kit changed its URI naming around the beginning of May, moving from explicit names like "/load_module.php?e=Adobe-2010-2884" to simpler files such as "/modules/2.swf" and "/modules/1.jar", with landing pages using "/load_module.php?user=" set to n1, 1, 2, or 11. Talos listed hashes tied to CVE-2013-0634, CVE-2014-0515, CVE-2011-3544, CVE-2012-1723, CVE-2013-2465 and CVE-2013-2465, five hostnames including www.rouleta.org and tsp-team.com, and noted that several hashes are shared with the Nuclear exploit kit.
What you should know: Five hashes are shared between Bleeding Life and the Nuclear exploit kit, which suggests the two kits draw on common exploit code rather than operating independently. Defenders who only track one kit's signatures may miss the other.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2011-3544 CVE-2012-1723 CVE-2013-0634 CVE-2013-2465 CVE-2014-0515
Related: Continued analysis of the Lights Out Exploit Kit Cyber Risks ·
CVE-2013-2465: Oracle Java SE Unspecified Vulnerability Known Exploited Vulnerabilities · Mar 28, 2022
CVE-2011-3544: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022