Even as some cybercriminals shift to more sophisticated attack vectors, exploit kit creators are still targeting some of the oldest and most common software vulnerabilities.
Trend Micro’s July 2018 analysis of Rig, Angler, Sundown and other exploit kits suggested that cybercriminals are increasingly changing their approach by distributing cryptocurrency mining software, pushing out botnets and serving up banking Trojans.
At the same time, however, exploit kit creators are eschewing complex attack vectors and focusing on vulnerabilities that should have been patched long ago. This includes a Microsoft Windows VBScript engine remote code execution (CVE-2018-8174), as well as bugs in Internet Explorer (IE).
Software Vulnerabilities: Old Flaws, New Attacks
According to the Trend Micro findings, the most active kit since late 2017 is Rig, which has been upgraded at least four times and has outlasted others that were shut down or disappeared. Cybercriminals could potentially leverage IE and common Microsoft Office documents to take over the processing power of their victims’ machines to mine cryptocurrencies, steal banking credentials and payments or commit other malicious acts. Other active exploit kits include GrandSoft and Magnitude.
A June 2018 report from Palo Alto Networks also showed that some exploit kit creators are also targeting Adobe Flash Player. Overall, researchers observed at least eight different application vulnerabilities that accounted for 1,583 malicious URLs across 496 different domains during the first quarter of 2018.
Exploit Kit Creators Ride the Zero-Day Wave
A June 2018 Malwarebytes report, meanwhile, suggested that exploit kit creators are taking advantage of a recent surge in zero-day vulnerabilities and noted that even more are likely to emerge throughout the rest of the year. The researchers already detected a zero-day flaw involving Flash Player’s ActionScript language, which was used in two consecutive exploit kit attacks.
To reduce the risk of exploit kit attacks, especially those leveraging long-ignored vulnerabilities, IBM experts suggest that security leaders should adopt antivirus protection and implement strict patch-management policies to ensure that all software is regularly updated.
Sources: Trend Micro, Palo Alto Networks, Malwarebytes