The Angler exploit kit is again sailing the cyber seas and pillaging with impunity, adding one of the more recent machine-hijacking Flash holes to its arsenal.
The integration of Adobe Flash vulnerability (CVE-2015-8651) patched last month solidifies Angler’s position as the most popular and effective exploit kit on underground criminal markets.
Chinese security researcher known as ThreatBook reports the exploit kit is being used in phishing attacks under the so-called DarkHotel campaign.
Those attacks also involve the compromising of hotel networks in order to compromise executives who connect to Wi-Fi.
Successful exploits will drop a trojan named update.exe disguised as SSH key generation tools. It will also search for the presence of anti-virus platforms and researcher sandbox analysis tools.
The exploit kit is also being used to drop the dangerous Cryptowall ransomware.
The respected independent researcher known as “Kafeine” revealed the Flash exploit update.
“[The update] is not yet pushed to all Angler exploit kit threads, but is widely spread,” Kafeine says.
The exploit works against Flash version 220.127.116.11 and Firefox.
Kafeine says authors of rival exploit kits Nuclear, Magnitude, and Neutrino are likely unable to mimic Angler’s exploit integration thanks to its use of encryption. Those three are stuck using an October Flash vulnerability (CVE-2015-7645), while RIG and Sundown flounder with Adobe holes (CVE-2015-5122) from July. ®
Building secure multi-factor authentication