Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

How the EITest Campaign's Path to Angler EK Evolved Over Time

Summary: Unit 42 tracked the EITest campaign, first identified by Malwarebytes in October 2014, from thousands of compromised websites injecting scripts that led to Angler exploit kit. The injected script patterns stayed consistent while the gate URL changed: player.php?pid= became [random word].php?sid in 2015, and by mid-February 2016 the URL format changed more drastically, with the gate using the 85.93.0.0/24 block since January 2016 and .tk as the most common TLD that year.

What you should know: The EITest gate returns a Flash file and always generates two HTTP GET requests - the first retrieves the Flash file, the second returns script pointing to an Angler EK landing page - so a single blocked request does not break the chain. Unlike pseudo-Darkleech, which pushes ransomware like CryptoWall or TeslaCrypt, the group behind EITest delivers a variety of malware, widening what a successful infection can mean for the victim.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related