Trusted Design

Angler EK: More Obfuscation, Fake Extensions, and Other Nonsense

概要

Late last week Talos researchers noticed a drastic uptick in Angler Exploit Kit activity. We have covered Angler previously, such as the discussion of domain shadowing. This exploit kit evolves on an almost constant basis. However, the recent activity caught our attention due to a change to the URL structure of the landing pages. This type of change doesn’t occur often and was coupled with some other interesting tidbits including how the HTTP 302 cushioning has evolved and the payload of another ransomware has changed.

Created: 2026-02-23

Indicators

• FileHash-SHA256 - 28f6b5f344f7d2bef75b30ba2e286ddff3d3a2009da1d01d7e30e21feecfde34 -
• FileHash-SHA256 - 023de93e9d686bf6a1f80ad68bde4f94c5100b534f95285c1582fb8b8be8d31f -

類似Pulses

• Another example of Angler exploit kit pushing CryptoWall 3.0 (score: 0.78)
• Chinese Government Website Compromised, Leads to Angler (score: 0.75)
• Alienvault Labs: Malvertising leading to the Angler Exploit Kit (score: 0.74)
• Large Malvertising Campaign Leads to Angler EK & Bunitu Malware (score: 0.72)
• Angler EK delivers Alpha Crypt Ransomware (score: 0.71)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る