The RIG exploit kit appears to be the new guy on the cybercrime block, and it’s stepping up to void left by older, fledgling kits.

Anti-malware firm Malwarebytes noted the sharp drop for the Angler exploit kit in June. An alleged major participant in the kit was arrested, which likely threw a monkey wrench into the operations.

The Neutrino exploit kit then assumed the dominant position in the cybercriminal niche. Malicious actors still wanted malware delivered and went with what would work best.

RIG Exploit Kit Claims the Throne

But Malwarebytes recently reported yet another change: The new exploit kit has replaced Neutrino on what the firm called “several high-volume attacks from compromised websites.” One particular RIG-infected site carried a malicious advertisement that needed only to be viewed to spread its infection — no clicking required.

It appears that cybercriminals lost trust in Neutrino after Cisco and GoDaddy successfully destroyed a campaign using the exploit kit, as Softpedia reported. That’s when they turned to a new and improved version of RIG.

Malwarebytes noted a change in how RIG disseminates its malware payload: Its researchers discovered wscript.exe to be the parent process of the dropped binary. Notably, Neutrino is the only other exploit kit that uses this process.

CryptMIC Dodges Antivirus Detection

Not so coincidentally, malvertising campaigns that were served by the RIG exploit kit started dumping the CryptMIC ransomware. This ransomware had previously been dropped only by Neutrino.

According to Heimdal Security, CryptMIC is spread by a randomly named file that runs under a logged-in user’s name. The malicious file immediately connects to a central command-and-control (C&C) server over TCP port 443.

Antivirus software typically does a poor job of detecting CryptMIC because this second-generation ransomware mutates to avoid a static signature that could give it away. It has developed many other ways to remain dynamic, including new URL patterns in its iFrames.

Detecting this sneaky malware would require a specialized program that is aware of the DNS shadowing and forum-like URLs. Currently, however, VirusTotal found that only four out of 57 antivirus solutions were able to identify it, Heimdal reported.