June 14, 2016 By Larry Loeb 2 min read

The Angler exploit kit (EK), which has been widely used by the cybercriminal world especially for malvertising campaigns, seems to be kaput.

Security researchers found that the traffic attributed to Angler use nose-dived in the last few weeks. The slack seems to be picked up by an increased use of the Neutrino exploit kit.

The SANS ISC Infosec Forum also noted that CryptXXX is starting to show up as a Neutrino-associated malware, something that researchers hadn’t seen before. It seems that there is a demonstrable shift in malware distribution occurring.

Neutrino’s Stock Goes Up

The Neutrino EK is stepping up as the Angler EK goes down. Malware don’t need Coffee said that Neutrino just doubled its price on the underground market, going from $3,500 per month to $7,000. It also dropped its weekly rental option in favor of more lucrative packages. That seems to indicate the Neutrino operators feel they are in a good position to negotiate — for now.

Of course, increased Neutrino traffic can only raise its profile as a target, and it’s a target that will loom large on Neutrino’s back the more it gets used. In the meantime, admins will likely try to grab as much money as they can while the competition is down and they are up.

But a question remains for all kinds of these episodes: For how long will Angler be down? EKs have shut down in the past when the malware administrator was away or had run-ins with police or other authorities. This could be a possibility for Angler as well.

Connecting the Angler Exploit Kit and Lurk Arrests

Malware don’t need Coffee noted that the Angler downtime may be related to the arrests of a Russian hacking gang believed to be behind a Trojan called Lurk. “With the recent 50 arrests tied to Lurk in mind, and knowing the infection vector for Lurk was the Indexm variant of Angler between 2012 and beginning of 2016 … we might think there is a connection and that some actors are stepping back,” researchers wrote on the blog.

Correlation is not causality, but that kind of link is both long-term and significant. It seems reasonable that the cybercriminals behind Lurk could have been running the EK. After the takedown, all the EK help may have relocated for its own protection.

Someone will likely try to bring the Angler exploit kit back someday, but it won’t be an easy trick to pull off. Until then, it’s time for researchers to turn their attention to Neutrino and other EKs that are ready to take off.

More from

SoaPy: Stealthy enumeration of Active Directory environments through ADWS

10 min read - Introduction Over time, both targeted and large-scale enumeration of Active Directory (AD) environments have become increasingly detected due to modern defensive solutions. During our internship at X-Force Red this past summer, we noticed FalconForce’s SOAPHound was becoming popular for enumerating Active Directory environments. This tool brought a new perspective to Active Directory enumeration by performing collection via Active Directory Web Services (ADWS) instead of directly through Lightweight Directory Access Protocol (LDAP) as other AD enumeration tools had in the past.…

Smoltalk: RCE in open source agents

26 min read - Big shoutout to Hugging Face and the smolagents team for their cooperation and quick turnaround for a fix! Introduction Recently, I have been working on a side project to automate some pentest reconnaissance with AI agents. Just after I started this project, Hugging Face announced the release of smolagents, a lightweight framework for building AI agents that implements the methodology described in the ReAct paper, emphasizing reasoning through iterative decision-making. Interestingly, smolagents enables agents to reason and act by generating…

4 ways to bring cybersecurity into your community

4 min read - It’s easy to focus on technology when talking about cybersecurity. However, the best prevention measures rely on the education of those who use technology. Organizations training their employees is the first step. But the industry needs to expand the concept of a culture of cybersecurity and take it from where it currently stands as an organizational responsibility to a global perspective.When every person who uses technology — for work, personal use and school — views cybersecurity as their responsibility, it…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today