Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Back to Locky
Summary: By mid-July 2016, the Afraidgate campaign stopped distributing CryptXXX ransomware and began consistently delivering the .zepto variant of Locky, with July 11, 2016 the last observed CryptXXX delivery. The campaign moved to Neutrino exploit kit after Angler EK disappeared in early June 2016, and the Zepto variant of Locky appeared after a three-week Necurs botnet outage ended on June 21, 2016.
Why it matters: Afraidgate, EITest and pseudo-Darkleech all moved from Angler to Neutrino after Angler vanished, and Neutrino now carries the bulk of exploit-kit ransomware infections - so the takedown of one kit did not reduce the volume, it just consolidated it onto a single distribution channel.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026