Understanding Angler Exploit Kit - Part 2: Examining Angler EK
Summary: Unit 42's second post on exploit kits profiles Angler EK, which it calls one of the most advanced and popular kits in the cyber criminal market, rented underground for a few thousand dollars a month under a SaaS model and named by researchers after an Anglerfish image in late-2013 advertisements. The kit integrated a Flash exploit for CVE-2015-5119 hours after the Hacking Team data dump made it public, ran it as a zero-day at least 24 hours before Adobe patched, and by 2016 was delivering ransomware that shifted from CryptoWall to TeslaCrypt to CryptXXX, alongside Bedep fileless infections and click-fraud traffic.
Key Takeaway: Angler weaponized a leaked Flash zero-day within hours of a public data dump, so the gap between a vulnerability becoming public and being exploited in a rented kit is measured in hours, not weeks - and the payload it most often delivers is ransomware.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Mentions
- CVE-2015-2419CVE-2015-5119CVE-2016-0034
- Related
- CVE-2016-0034: Microsoft Silverlight Runtime Remote Code Execution Vulnerability Known Exploited Vulnerabilities · May 25, 2022CVE-2015-2419: Microsoft Internet Explorer Memory Corruption Vulnerability Known Exploited Vulnerabilities · Mar 28, 2022