Trusted Design

CryptoWall sent by Angler and Neutrino exploit kits

概要

Since August 2015, actors using Angler exploit kit (EK) to send ransomware have occasionally switched back and forth between Angler EK and Neutrino EK. Sometime in mid-August 2015, actors using Angler EK to send ransomware switched to Neutrino EK [1]. The next week, those actors were back to using Angler EK [2, 3] and we've seen the occasional switching back and forth since then. I hadn't seen much Neutrino EK at all in November and December of 2015, but these actors switched back to Neutrino EK by the first week of January [4]. This occasional switch between the two EKs can be confusing. I've seen this EK switch initially confuse more than one security professional [5]. As of Tuesday 2016-01-12, these actors are back to Angler EK. And as always, we continue to see malicious spam (malspam) as another vector for ransomware. Source : https://isc.sans.edu/forums/diary/CryptoWall+sent+by+Angler+and+Neutrino+exploit+kits+or+through+malicious+spam/20611/

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• Actor that tried Neutrino exploit kit now back to Angler (score: 0.69)
• Angler EK delivers Alpha Crypt Ransomware (score: 0.67)
• Neutrino Campaign Leveraging WordPress, Flash for CryptoWall (score: 0.66)
• CryptXXX: New Ransomware From the Actors Behind Reveton (score: 0.65)
• 2015-09-29 - ANGLER EK FROM 85.25.102.2 SENDS CRYPTOWALL 3.0 (score: 0.64)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る