Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX

Summary: In mid-April 2016, a campaign Palo Alto Networks calls Afraidgate switched from using Nuclear Exploit Kit to deliver Locky ransomware to using Angler Exploit Kit to install CryptXXX, with gates registered through FreeDNS at afraid.org. Angler delivers Bedep via a fileless technique that loads it directly into memory, and Bedep then installs CryptXXX plus click-fraud malware, behaving differently when it detects a virtual machine.

Why it matters: CryptXXX became the default ransomware in at least two major exploit kit campaigns, and Bedep's VM detection means researchers and defenders testing it in virtual machines see different post-infection traffic and no CryptXXX download at all.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related