June 14, 2016 By Larry Loeb 2 min read

The Angler exploit kit (EK), which has been widely used by the cybercriminal world especially for malvertising campaigns, seems to be kaput.

Security researchers found that the traffic attributed to Angler use nose-dived in the last few weeks. The slack seems to be picked up by an increased use of the Neutrino exploit kit.

The SANS ISC Infosec Forum also noted that CryptXXX is starting to show up as a Neutrino-associated malware, something that researchers hadn’t seen before. It seems that there is a demonstrable shift in malware distribution occurring.

Neutrino’s Stock Goes Up

The Neutrino EK is stepping up as the Angler EK goes down. Malware don’t need Coffee said that Neutrino just doubled its price on the underground market, going from $3,500 per month to $7,000. It also dropped its weekly rental option in favor of more lucrative packages. That seems to indicate the Neutrino operators feel they are in a good position to negotiate — for now.

Of course, increased Neutrino traffic can only raise its profile as a target, and it’s a target that will loom large on Neutrino’s back the more it gets used. In the meantime, admins will likely try to grab as much money as they can while the competition is down and they are up.

But a question remains for all kinds of these episodes: For how long will Angler be down? EKs have shut down in the past when the malware administrator was away or had run-ins with police or other authorities. This could be a possibility for Angler as well.

Connecting the Angler Exploit Kit and Lurk Arrests

Malware don’t need Coffee noted that the Angler downtime may be related to the arrests of a Russian hacking gang believed to be behind a Trojan called Lurk. “With the recent 50 arrests tied to Lurk in mind, and knowing the infection vector for Lurk was the Indexm variant of Angler between 2012 and beginning of 2016 … we might think there is a connection and that some actors are stepping back,” researchers wrote on the blog.

Correlation is not causality, but that kind of link is both long-term and significant. It seems reasonable that the cybercriminals behind Lurk could have been running the EK. After the takedown, all the EK help may have relocated for its own protection.

Someone will likely try to bring the Angler exploit kit back someday, but it won’t be an easy trick to pull off. Until then, it’s time for researchers to turn their attention to Neutrino and other EKs that are ready to take off.

More from

What cybersecurity pros can learn from first responders

4 min read - Though they may initially seem very different, there are some compelling similarities between cybersecurity professionals and traditional first responders like police and EMTs. After all, in a world where a cyberattack on critical infrastructure could cause untold damage and harm, cyber responders must be ready for anything.But are they actually prepared? Compared to the readiness of traditional first responders, how do cybersecurity professionals in incident response stand up? Let’s dig deeper into whether the same sense of urgency exists in…

Unified endpoint management for purpose-based devices

4 min read - As purpose-built devices become increasingly common, the challenges associated with their unique management and security needs are becoming clear. What are purpose-built devices? Most fall under the category of rugged IoT devices typically used outside of an office environment and which often run on a different operating system than typical office devices. Examples include ruggedized tablets and smartphones, handheld scanners and kiosks. Many different industries are utilizing purpose-built devices, including travel and transportation, retail, warehouse and distribution, manufacturing (including automotive)…

Stealthy WailingCrab Malware misuses MQTT Messaging Protocol

14 min read - This article was made possible thanks to the hard work of writer Charlotte Hammond and contributions from Ole Villadsen and Kat Metrick. IBM X-Force researchers have been tracking developments to the WailingCrab malware family, in particular, those relating to its C2 communication mechanisms, which include misusing the Internet-of-Things (IoT) messaging protocol MQTT. WailingCrab, also known as WikiLoader, is a sophisticated, multi-component malware delivered almost exclusively by an initial access broker that X-Force tracks as Hive0133, which overlaps with TA544. WailingCrab…

Operationalize cyber risk quantification for smart security

4 min read - Organizations constantly face new tactics from cyber criminals who aim to compromise their most valuable assets. Yet despite evolving techniques, many security leaders still rely on subjective terms, such as low, medium and high, to communicate and manage cyber risk. These vague terms do not convey the necessary detail or insight to produce actionable outcomes that accurately identify, measure, manage and communicate cyber risks. As a result, executives and board members remain uninformed and ill-prepared to manage organizational risk effectively.…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today