The Angler exploit kit (EK), which has been widely used by the cybercriminal world especially for malvertising campaigns, seems to be kaput.

Security researchers found that the traffic attributed to Angler use nose-dived in the last few weeks. The slack seems to be picked up by an increased use of the Neutrino exploit kit.

The SANS ISC Infosec Forum also noted that CryptXXX is starting to show up as a Neutrino-associated malware, something that researchers hadn’t seen before. It seems that there is a demonstrable shift in malware distribution occurring.

Neutrino’s Stock Goes Up

The Neutrino EK is stepping up as the Angler EK goes down. Malware don’t need Coffee said that Neutrino just doubled its price on the underground market, going from $3,500 per month to $7,000. It also dropped its weekly rental option in favor of more lucrative packages. That seems to indicate the Neutrino operators feel they are in a good position to negotiate — for now.

Of course, increased Neutrino traffic can only raise its profile as a target, and it’s a target that will loom large on Neutrino’s back the more it gets used. In the meantime, admins will likely try to grab as much money as they can while the competition is down and they are up.

But a question remains for all kinds of these episodes: For how long will Angler be down? EKs have shut down in the past when the malware administrator was away or had run-ins with police or other authorities. This could be a possibility for Angler as well.

Connecting the Angler Exploit Kit and Lurk Arrests

Malware don’t need Coffee noted that the Angler downtime may be related to the arrests of a Russian hacking gang believed to be behind a Trojan called Lurk. “With the recent 50 arrests tied to Lurk in mind, and knowing the infection vector for Lurk was the Indexm variant of Angler between 2012 and beginning of 2016 … we might think there is a connection and that some actors are stepping back,” researchers wrote on the blog.

Correlation is not causality, but that kind of link is both long-term and significant. It seems reasonable that the cybercriminals behind Lurk could have been running the EK. After the takedown, all the EK help may have relocated for its own protection.

Someone will likely try to bring the Angler exploit kit back someday, but it won’t be an easy trick to pull off. Until then, it’s time for researchers to turn their attention to Neutrino and other EKs that are ready to take off.