Hiking Club Malvertisements Drop Monero Miners Via Neptune Exploit Kit[html]
Exploit kit (EK) activity has been on the decline ever since href="https://securityintelligence.com/news/say-goodbye-to-the-angler-exploit-kit/">Angler
Exploit Kit was shut down in 2016. href="https://threatpost.com/exploit-kit-activity-quiets-but-is-far-from-silent/124461/">Fewer
people using Internet Explorer and a href="https://blog.mozilla.org/futurereleases/2016/07/20/reducing-adobe-flash-usage-in-firefox/">drop
in browser support for Adobe Flash – two primary targets of many
exploit kits – have also contributed to this decline. Additionally,
some popular redirect campaigns using href="http://www.darkreading.com/attacks-breaches/rig-exploit-kit-takedown-sheds-light-on-domain-shadowing/d/d-id/1329085">PseudoDarkleech
and EITest Gate to Rig Exploit Kit were shut down in first half
of this year.
Despite all this, href="https://www.fireeye.com/blog/threat-research/2017/03/still_getting_served.html">malvertising
campaigns involving exploits kits remain active. The Neptune
Exploit Kit (or Terror EK), which initially started as a Sundown EK
copycat operation, has relied heavily on malvertisements. Early use of
this exploit kit saw domains with very similar patterns dropping
cryptocurrency miners through malvertisements:
- networkmarketingpro3[.]us
- networkmarketingpro2[.]us
- onlinesalesproaffiliate1[.]us
- onlinesalesproaffiliate2[.]us
- onlinesalesproaffiliate3[.]us
- onlinesalesproaffiliate4[.]us
- onlinesalesproaffiliate5[.]us
- onlinesalesproaffiliate6[.]us
Payloads spread by Neptune Exploit Kit have since diversified.
Recently, we have seen changes in Neptune EK’s URI patterns, landing
pages, malvertisement campaigns and login account details associated
with the cryptocurrency mining payloads.
