July 25, 2018 By Shane Schick 2 min read

Even as some cybercriminals shift to more sophisticated attack vectors, exploit kit creators are still targeting some of the oldest and most common software vulnerabilities.

Trend Micro’s July 2018 analysis of Rig, Angler, Sundown and other exploit kits suggested that cybercriminals are increasingly changing their approach by distributing cryptocurrency mining software, pushing out botnets and serving up banking Trojans.

At the same time, however, exploit kit creators are eschewing complex attack vectors and focusing on vulnerabilities that should have been patched long ago. This includes a Microsoft Windows VBScript engine remote code execution (CVE-2018-8174), as well as bugs in Internet Explorer (IE).

Software Vulnerabilities: Old Flaws, New Attacks

According to the Trend Micro findings, the most active kit since late 2017 is Rig, which has been upgraded at least four times and has outlasted others that were shut down or disappeared. Cybercriminals could potentially leverage IE and common Microsoft Office documents to take over the processing power of their victims’ machines to mine cryptocurrencies, steal banking credentials and payments or commit other malicious acts. Other active exploit kits include GrandSoft and Magnitude.

A June 2018 report from Palo Alto Networks also showed that some exploit kit creators are also targeting Adobe Flash Player. Overall, researchers observed at least eight different application vulnerabilities that accounted for 1,583 malicious URLs across 496 different domains during the first quarter of 2018.

Exploit Kit Creators Ride the Zero-Day Wave

A June 2018 Malwarebytes report, meanwhile, suggested that exploit kit creators are taking advantage of a recent surge in zero-day vulnerabilities and noted that even more are likely to emerge throughout the rest of the year. The researchers already detected a zero-day flaw involving Flash Player’s ActionScript language, which was used in two consecutive exploit kit attacks.

To reduce the risk of exploit kit attacks, especially those leveraging long-ignored vulnerabilities, IBM experts suggest that security leaders should adopt antivirus protection and implement strict patch-management policies to ensure that all software is regularly updated.

Sources: Trend Micro, Palo Alto Networks, Malwarebytes

More from

What is the Open-Source Software Security Initiative (OS3I)?

3 min read - The Open-Source Software Security Initiative (OS3I) recently released Securing the Open-Source Software Ecosystem report, which details the members’ current priorities and recommended cybersecurity solutions. The accompanying fact sheet also provides the highlights of the report. The OS3I includes both federal departments and agencies working together to deliver policy solutions to secure and defend the ecosystem. The new initiative is part of the overall National Cybersecurity Strategy.After the Log4Shell vulnerability in 2021, the Biden-Harris administration committed to improving the security of…

Widespread exploitation of recently disclosed Ivanti vulnerabilities

6 min read - IBM X-Force has assisted several organizations in responding to successful compromises involving the Ivanti appliance vulnerabilities disclosed in January 2024. Analysis of these incidents has identified several Ivanti file modifications that align with current public reporting. Additionally, IBM researchers have observed specific attack techniques involving the theft of authentication token data not readily noted in current public sources. The blog details the results of this research to assist organizations in protecting against these threats. Key Findings: IBM research teams have…

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today