October 21, 2019 By David Bisson 2 min read

The Spelevo exploit kit (EK) abuses a vulnerability affecting Flash Player to infect users with samples of the Maze ransomware family.

Security researcher nao_sec, who was the first to publicly report the new Maze ransomware campaign, noted that it redirects users to Spelevo, according to Bleeping Computer. The exploit kit attempts to abuse CVE-2018-15982, a use-after-free vulnerability, within the browser to specifically target users of Flash Player versions 31.0.0.153 / 31.0.0.108 and earlier. If it finds a vulnerable user, Spelevo exploits the weakness and leverages arbitrary code execution to install Maze on the user’s computer.

Upon successful infection, the ransomware sample analyzed by Bleeping Computer began scanning the computer for interesting files, including documents and photos. It then used RSA encryption and the ChaCha20 stream cipher to encrypt all the files it could find before dropping a ransom note into every folder containing affected data. The note instructed victims to visit a website hosted on the Tor network for payment instructions.

Tracking the Evolution of Spelevo

Spelevo is a relatively new cyberthreat that is still evolving. Researchers at Malware-Traffic-Analysis.net first spotted the exploit kit in March 2019. At the time, the threat was using Flash-based exploits.

Around the same time, Fox-IT observed Spelevo distributing PsiXBot, a modular piece of malware.

In June, Cisco Talos conducted a deep dive into Spelevo’s activity and found that the exploit kit was primarily targeting vulnerable users with banking Trojans such as IcedID and Dridex.

How to Defend Against the Maze Ransomware Campaign

Security professionals can help their organizations defend against Maze ransomware borne by exploit kits such as Spelevo by connecting their comprehensive vulnerability management solutions to their security information and event management (SIEM), networking monitoring and patch management tools to help streamline the response to new security bugs. Additionally, security teams should craft a patch management strategy that espouses thoughtful prioritization and collaboration among different teams.

More from

Cyberattack on American Water: A warning to critical infrastructure

3 min read - American Water, the largest publicly traded United States water and wastewater utility, recently experienced a cybersecurity incident that forced the company to disconnect key systems, including its customer billing platform. As the company’s investigation continues, there are growing concerns about the vulnerabilities that persist in the water sector, which has increasingly become a target for cyberattacks. The breach is a stark reminder of the critical infrastructure risks that have long plagued the industry. While the water utility has confirmed that…

What’s behind unchecked CVE proliferation, and what to do about it

4 min read - The volume of Common Vulnerabilities and Exposures (CVEs) has reached staggering levels, placing immense pressure on organizations' cyber defenses. According to SecurityScorecard, there were 29,000 vulnerabilities recorded in 2023, and by mid-2024, nearly 27,500 had already been identified.Meanwhile, Coalition's 2024 Cyber Threat Index forecasts that the total number of CVEs for 2024 will hit 34,888—a 25% increase compared to the previous year. This upward trend presents a significant challenge for organizations trying to manage vulnerabilities and mitigate potential exploits.What’s behind…

Quishing: A growing threat hiding in plain sight

4 min read - Our mobile devices go everywhere we go, and we can use them for almost anything. For businesses, the accessibility of mobile devices has also made it easier to create more interactive ways to introduce new products and services while improving user experiences across different industries. Quick-response (QR) codes are a good example of this in action and help mobile devices quickly navigate to web pages or install new software by simply scanning an image.However, legitimate organizations aren’t the only ones…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today