I'm calling this Goon Exploit Kit, for now
Summary: Cisco Talos began seeing this exploit kit in its systems on November 21st, noting similarities to Redkit and the Dotcache exploit kit. The chain uses a cookiebomb redirect to 173.237.187.203, a landing page at vinnypedulla.com, and a JNLP bypass in an XML file exploiting CVE-2012-0507 to fetch browser.jar, with the payload returning a 404 at the time of investigation before later research showed the kit dropping an XOR'd binary of ZeroAccess.
Why it matters: Talos detected 60 installs of this kit in a single day, and its JNLP bypass only gets caught if VRT rule 26524 is enabled and running in IPS mode - a gap worth checking against your own sensor configuration.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026