A recent attack campaign leveraged a business-to-business (B2B) website to distribute a new exploit kit named Spelevo.
After observing an increase in exploit kit activity, Cisco Talos noticed that threat actors had gained control of the B2B site’s homepage and added a few lines of code. With this small modification, the malefactors seized the ability to abuse the website as a means of redirection for their attacks.
The redirection led users to a landing page for the campaign. There, the operation analyzed each user’s computer for possible exploit channels by collecting information about what operating systems, web browsers and plugins were in use.
Cisco Talos found that Spelevo specifically came equipped with the ability to exploit CVE-2018-8174, a use-after-free vulnerability that affects the VBScript engine of Internet Explorer and, in turn, delivers either IcedID or Dridex malware. Finally, the exploit kit redirected to Google to trick the user into thinking that everything was normal.
Inside the Surge of Exploit Kit Activity
This campaign comes on the heels of a recent surge in exploit kit activity. In May 2019, for instance, Malwarebytes noted that it had seen exploit kit activity expand with the addition of Spelevo as well as the Router exploit kit, a threat package that is known for launching drive-by attacks as a means of altering vulnerable routers’ DNS settings via cross-site request forgery (CSRF).
New exploit kits weren’t the only source of this activity, however; security firms have witnessed plenty of old faces join in the fray. Among them was the RIG exploit kit, a threat that attracted Bleeping Computer‘s attention when it began pushing Buran ransomware in June. Later that same month, Bleeping Computer observed RIG distributing Sodinokibi ransomware.
How to Defend Against Spelevo and Other Exploit Kits
Security professionals can help defend their organizations against Spelevo and other exploit kits by using security information and event management (SIEM) data to contextualize known vulnerabilities. Organizations should also consider investing in tools through which they can prioritize remediation tasks as part of a comprehensive vulnerability management strategy.