Exploit kit (EK) activity has been on the decline ever since
Exploit Kit was shut down in 2016.
people using Internet Explorer and a
in browser support for Adobe Flash – two primary targets of many
exploit kits – have also contributed to this decline. Additionally,
some popular redirect campaigns using
and EITest Gate to Rig Exploit Kit were shut down in first half
of this year.
Despite all this,
campaigns involving exploits kits remain active. The Neptune
Exploit Kit (or Terror EK), which initially started as a Sundown EK
copycat operation, has relied heavily on malvertisements. Early use of
this exploit kit saw domains with very similar patterns dropping
cryptocurrency miners through malvertisements:
Payloads spread by Neptune Exploit Kit have since diversified.
Recently, we have seen changes in Neptune EK’s URI patterns, landing
pages, malvertisement campaigns and login account details associated
with the cryptocurrency mining payloads.