Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Campaign Evolution: pseudo-Darkleech in 2016

Summary: Unit 42's review of the pseudo-Darkleech campaign, first identified in 2012, traces its 2016 shifts: it used Angler EK until that kit disappeared in mid-June 2016, moved to Neutrino EK until Neutrino ceased operations in mid-September 2016, then switched to Rig EK. Its ransomware payload moved from TeslaCrypt to CryptXXX in April 2016 after TeslaCrypt shut down and released its master decryption key, to the CrypMIC variant by August 2016, and to Cerber by October 2016, while the injected script on compromised sites dropped from 12,000-18,000 obfuscated characters to a short, unobfuscated iframe by July 1st 2016.

Bottom line: The campaign swapped exploit kits and ransomware families at least four times in one year, so any indicator set built around a single EK or payload goes stale within months.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related