Nov 28, 2019, 15:03 pm
The malware landscape is in a constant flux, with new trends and techniques appearing and/or going out of fashion on a monthly basis.
Keeping an eye on what's what involves analyzing tens of thousands of malware samples, and this is exactly what the Malwarebytes team has been doing in terms of exploit kits, collecting and indexing campaigns and attacks for the past few years in order to get an insight into how the exploit kit landscape operates and might shift in the future.
What are exploit kits?
Exploit kits, or EKs, are web-based applications hosted by cyber-criminals. EK operators usually buy web traffic from malvertising campaigns or botnet operators.
Traffic from malicious ads or hacked websites is sent to an EK's so-called "gate" where the EK operator selects only users with specific browsers or Adobe Flash versions and redirects these possible targets to a "landing page."
Here is where the EK runs an exploit -- hence the name exploit kit -- and uses a browser or Flash vulnerability to plant and execute malware on a user's computer.
Fileless Attacks
In a report released last week, Malwarebytes researchers say EK operators are changing their tactics.
Instead of relying on dropping malware on disk and then executing the malware, at least three of the nine currently active EKs are now using fileless attacks.
A fileless attack relies on loading the malicious code inside the computer's RAM, without leaving any traces on disk.
Fileless malware has been around for more than half a decade, but this is the first time EKs are broadly adopting the technique.
"This is an interesting trend that makes sample sharing more difficult and possibly increases infection rates by evading some security products," said Jérôme Segura, Malwarebytes malware analyst.
The exploit kits leveraging this technique include Magnitude, Underminer, and Purple Fox.
These are small-time exploit kits when compared to other more broadly used EKs like Spelevo, Fallout, and RIG. However, this doesn't matter. The fact that a third of today's top EKs are using fileless techniques shows a clear direction where the EK market will be going in the following months and years.
One recent trend with the actors behind the exploit kits has been to focus on the vulnerabilities in Internet Explorer.
Most IE instances today are in enterprise networks. Enterprise networks are highly sought-after targets by EK operators.
https://www.zdnet.com/article/exploit-ki...s-attacks/
Keeping an eye on what's what involves analyzing tens of thousands of malware samples, and this is exactly what the Malwarebytes team has been doing in terms of exploit kits, collecting and indexing campaigns and attacks for the past few years in order to get an insight into how the exploit kit landscape operates and might shift in the future.
What are exploit kits?
Exploit kits, or EKs, are web-based applications hosted by cyber-criminals. EK operators usually buy web traffic from malvertising campaigns or botnet operators.
Traffic from malicious ads or hacked websites is sent to an EK's so-called "gate" where the EK operator selects only users with specific browsers or Adobe Flash versions and redirects these possible targets to a "landing page."
Here is where the EK runs an exploit -- hence the name exploit kit -- and uses a browser or Flash vulnerability to plant and execute malware on a user's computer.
Fileless Attacks
In a report released last week, Malwarebytes researchers say EK operators are changing their tactics.
Instead of relying on dropping malware on disk and then executing the malware, at least three of the nine currently active EKs are now using fileless attacks.
A fileless attack relies on loading the malicious code inside the computer's RAM, without leaving any traces on disk.
Fileless malware has been around for more than half a decade, but this is the first time EKs are broadly adopting the technique.
"This is an interesting trend that makes sample sharing more difficult and possibly increases infection rates by evading some security products," said Jérôme Segura, Malwarebytes malware analyst.
The exploit kits leveraging this technique include Magnitude, Underminer, and Purple Fox.
These are small-time exploit kits when compared to other more broadly used EKs like Spelevo, Fallout, and RIG. However, this doesn't matter. The fact that a third of today's top EKs are using fileless techniques shows a clear direction where the EK market will be going in the following months and years.
One recent trend with the actors behind the exploit kits has been to focus on the vulnerabilities in Internet Explorer.
Most IE instances today are in enterprise networks. Enterprise networks are highly sought-after targets by EK operators.
https://www.zdnet.com/article/exploit-ki...s-attacks/