July 1, 2019 By David Bisson 2 min read

A recent attack campaign leveraged a business-to-business (B2B) website to distribute a new exploit kit named Spelevo.

After observing an increase in exploit kit activity, Cisco Talos noticed that threat actors had gained control of the B2B site’s homepage and added a few lines of code. With this small modification, the malefactors seized the ability to abuse the website as a means of redirection for their attacks.

The redirection led users to a landing page for the campaign. There, the operation analyzed each user’s computer for possible exploit channels by collecting information about what operating systems, web browsers and plugins were in use.

Cisco Talos found that Spelevo specifically came equipped with the ability to exploit CVE-2018-8174, a use-after-free vulnerability that affects the VBScript engine of Internet Explorer and, in turn, delivers either IcedID or Dridex malware. Finally, the exploit kit redirected to Google to trick the user into thinking that everything was normal.

Inside the Surge of Exploit Kit Activity

This campaign comes on the heels of a recent surge in exploit kit activity. In May 2019, for instance, Malwarebytes noted that it had seen exploit kit activity expand with the addition of Spelevo as well as the Router exploit kit, a threat package that is known for launching drive-by attacks as a means of altering vulnerable routers’ DNS settings via cross-site request forgery (CSRF).

New exploit kits weren’t the only source of this activity, however; security firms have witnessed plenty of old faces join in the fray. Among them was the RIG exploit kit, a threat that attracted Bleeping Computer‘s attention when it began pushing Buran ransomware in June. Later that same month, Bleeping Computer observed RIG distributing Sodinokibi ransomware.

How to Defend Against Spelevo and Other Exploit Kits

Security professionals can help defend their organizations against Spelevo and other exploit kits by using security information and event management (SIEM) data to contextualize known vulnerabilities. Organizations should also consider investing in tools through which they can prioritize remediation tasks as part of a comprehensive vulnerability management strategy.

More from

How generative AI Is expanding the insider threat attack surface

3 min read - As the adoption of generative AI (GenAI) soars, so too does the risk of insider threats. This puts even more pressure on businesses to rethink security and confidentiality policies.In just a few years, artificial intelligence (AI) has radically changed the world of work. 61% of knowledge workers now use GenAI tools — particularly OpenAI’s ChatGPT — in their daily routines. At the same time, business leaders, often partly driven by a fear of missing out, are investing billions in tools…

Water facilities warned to improve cybersecurity

3 min read - United States water facilities, which include 150,000 public water systems, have become an increasingly high-risk target for cyber criminals in recent years. This rising threat has demanded more attention and policies focused on improving cybersecurity.Water and wastewater systems are one of the 16 critical infrastructures in the U.S. The definition for inclusion in this category is that the industry must be so crucial to the United States that “the incapacity or destruction of such systems and assets would have a…

New ransomware over browser threat targets uploaded files

3 min read - We all have a mental checklist of things not to do while online: click on unknown links, use public networks and randomly download files sent over email. In the past, most ransomware was deployed on your network or computer when you downloaded a file that contained malware. But now it’s time to add a new item to our high-risk activity checklist: use caution when uploading files. What is ransomware over browsers? Researchers at Florida International University worked with Google to…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today