Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Decline in Rig Exploit Kit

Summary: Unit 42 reported that Rig exploit kit activity fell sharply starting in April 2017 after the pseudo-Darkleech campaign stopped appearing at the end of March, cutting Rig traffic by roughly 50 percent, and the EITest campaign shifted to tech support scams near the end of April, cutting it by another 50 percent in May. The report attributes the broader decline in exploit kits to a shrinking target base, noting that Microsoft Edge and Internet Explorer 11 combined held only 19 percent of the desktop browser market as of May 2017, along with a lack of new zero-day exploits and takedowns of domain shadowing infrastructure by Cisco Talos in 2016 and RSA Research in 2017.

What's compelling: Two long-running campaigns walking away from Rig cut its traffic in half twice in two months, and EITest's move to tech support scams shows criminals following revenue rather than exploits. The EITest scam pages described here cannot be closed by clicking or shutting the browser window, only by killing the browser process in task manager.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related