Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Rig EK One Year Later: From Ransomware to Coin Miners and Information Stealers

Summary: Unit 42 compared Rig EK activity in January 2017 with January 2018 and found verified sessions on the RigEKFlashContainer tag fell from 812 to 65, a 92 percent decrease. Over the same period the payload mix shifted: the ransomware families Rig EK pushed in January 2017 (Cerber, CryptoMix, CryptoShield, Locky, Spora) were no longer active, while AutoFocus coin miner samples rose from 2,368 to 65,512, a 2,766 percent increase, and Rig EK moved from domain shadowing to IP-address-based servers with Base64-encoded URL strings.

What's compelling: The volume of Rig EK traffic dropped 92 percent, yet coin miner samples in the same telemetry rose 2,766 percent - the infrastructure shrank while the monetization moved to quietly mining Monero on infected hosts, with the Ngay campaign also pushing the Remcos RAT and its keylogging component.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related