EITest Campaign Evolution: From Angler EK to Neutrino and Rig
Summary: Unit 42 reports that the EITest campaign, first identified in October 2014, moved from Angler EK to Neutrino EK after Angler disappeared in June 2016, then switched primarily to Rig EK by August 2016. In September 2016 the campaign began hiding its injected scripts with hex-obfuscated javascript, replaced the percent symbol with a hyphen by September 16, and simplified its gate URLs starting September 14.
Key Takeaway: EITest has run for three years and keeps changing its obfuscation and gate URLs while its gate IP addresses stay consistent for days or weeks, so indicators built on domains and script patterns go stale fast. The campaign continues to push a variety of malware through Rig EK with no sign of stopping.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026