Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Campaign Evolution: EITest from October through December 2016

Summary: Unit 42 reports that the EITest exploit kit campaign, tracked since Malwarebytes Labs named it in 2014, stopped using a gate between compromised websites and its exploit kit landing page after Palo Alto Networks published a blog on it on October 3, 2016, and stopped obfuscating the landing page URL in its injected script by October 15, 2016. The campaign continues to use Rig EK, most often the Empire Pack variant, to deliver information stealers such as Gootkit and the Chthonic banking Trojan, and less often ransomware including Cerber and CryptoMix.

What you should know: EITest has run since 2014 and keeps shifting its delivery chain, which Unit 42 reads as evidence that exploit kits remain profitable for the criminals involved. It has no specific target, so anyone running an out-of-date Windows system or out-of-date applications is exposed.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related