Threat Brief: A Declining Rig Exploit Kit Hops on the Coinmining Bandwagon
Summary: Unit 42 reports that the Rig Exploit Kit, still strong in January 2017, began a marked decline in April 2017 that continued through January 2018, with likely causes including a declining browser target base, lack of new exploits, efforts against domain shadowing, criminal arrests, and vendor browser hardening. What remains of Rig has shifted nearly wholesale from ransomware to information stealers and coinminers, and Unit 42 cites a nearly 2,800% increase in coinmining volume between January 2017 and January 2018.
Why it matters: A nearly 2,800% year-over-year rise in coinminer samples means the criminal business model moved to your compute and electricity, not your files - and Unit 42 notes it cannot say whether ransomware's decline reflects falling returns after WannaCry and NotPetya or attackers simply following each other.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026