Palo Alto Networks

Rig Exploit Kit

Rig EK One Year Later: From Ransomware to Coin Miners and Information Stealers

What a difference a year makes! As the dominant exploit kit (EK) in our current threat landscape, Rig EK has gone through significant changes. How much has Rig EK changed? In order to find out, we compared activity levels, malware payloads, and network traffic characteristics from January of 2017 with January of 2018. The contrast is striking.

Activity Levels: A Dramatic Drop...

Unit 42

Feb 26, 2018

By Brad Duncan

Palo Alto Networks

Products and Services

Partners

Threat Brief, Unit 42

Threat Brief: A Declining Rig Exploit Kit Hops on the Coinmining Bandwagon

In January 2017, Rig Exploit Kit (EK) was still in the middle of a strong run. But when April 2017 came, Rig started a very marked decline.

Feb 26, 2018

By Christopher Budd

Unit 42

Decline in Rig Exploit Kit

Starting in April 2017, we saw a significant decrease in Rig exploit kit (EK) activity after two major campaigns, EITest and pseudo-Darkleech, stopped using EKs. Figure 1 shows the hits for the Rig EK from December 2016 through May 2017, highlighting this trend.

Jun 21, 2017

By Brad Duncan

Unit 42

Campaign Evolution: EITest from October through December 2016

EITest is a name originally coined by Malwarebytes Labs in 2014 to describe a campaign that uses exploit kits (EKs) to deliver malware. Until early January 2016, "EITest" was used...

Jan 12, 2017

By Brad Duncan

Unit 42

Campaign Evolution: pseudo-Darkleech in 2016

Darkleech is long-running campaign that uses exploit kits (EKs) to deliver malware. First identified in 2012, this campaign has used different EKs to distribute various types of malware during the past few year...

Dec 30, 2016

By Brad Duncan

Load more blogs