MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-26 16:57:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Adapting to modification from Misp repository

Browse source
This commit is contained in:
Kafeine 2018-08-30 17:04:08 +02:00 committed by GitHub
parent 25d21204fb
commit 67e9ef2719
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 202 additions and 168 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

370
clusters/exploit-kit.json
View file

@ -1,45 +1,54 @@
{ {
"authors": [
"Kafeine",
"Will Metcalf",
"KahuSecurity"
],
"description": "Exploit-Kit is an enumeration of some exploitation kits used by adversaries. The list includes document, browser and router exploit kits.It's not meant to be totally exhaustive but aim at covering the most seen in the past 5 years",
"name": "Exploit-Kit",
"source": "MISP Project",
"type": "exploit-kit",
"uuid": "454f4e78-bd7c-11e6-a4a6-cec0c932ce01",
"values": [ "values": [
{ {
"value": "Astrum",
"description": "Astrum Exploit Kit is a private Exploit Kit used in massive scale malvertising campaigns. It's notable by its use of Steganography", "description": "Astrum Exploit Kit is a private Exploit Kit used in massive scale malvertising campaigns. It's notable by its use of Steganography",
"meta": { "meta": {
"refs": [ "refs": [
"http://malware.dontneedcoffee.com/2014/09/astrum-ek.html", "http://malware.dontneedcoffee.com/2014/09/astrum-ek.html",
"http://www.welivesecurity.com/2016/12/06/readers-popular-websites-targeted-stealthy-stegano-exploit-kit-hiding-pixels-malicious-ads/" "http://www.welivesecurity.com/2016/12/06/readers-popular-websites-targeted-stealthy-stegano-exploit-kit-hiding-pixels-malicious-ads/"
], ],
"status": "Active",
"synonyms": [ "synonyms": [
"Stegano EK" "Stegano EK"
], ]
"status": "Active"
}, },
"uuid": "e9ca60cd-94fc-4a54-ac98-30e675a46b3e" "uuid": "e9ca60cd-94fc-4a54-ac98-30e675a46b3e",
"value": "Astrum"
}, },
{ {
"value": "Bingo",
"description": "Bingo EK is the name chosen by the defense for a Fiesta-ish EK first spotted in March 2017 and targetting at that times mostly Russia", "description": "Bingo EK is the name chosen by the defense for a Fiesta-ish EK first spotted in March 2017 and targetting at that times mostly Russia",
"meta": { "meta": {
"status": "Active" "status": "Active"
}, },
"uuid": "9e864c01-3d9e-4b8d-811e-46471ff866e9" "uuid": "9e864c01-3d9e-4b8d-811e-46471ff866e9",
"value": "Bingo"
}, },
{ {
"value": "Terror EK",
"description": "Terror EK is built on Hunter, Sundown and RIG EK code", "description": "Terror EK is built on Hunter, Sundown and RIG EK code",
"meta": { "meta": {
"refs": [ "refs": [
"https://www.trustwave.com/Resources/SpiderLabs-Blog/Terror-Exploit-Kit--More-like-Error-Exploit-Kit/" "https://www.trustwave.com/Resources/SpiderLabs-Blog/Terror-Exploit-Kit--More-like-Error-Exploit-Kit/"
], ],
"status": "Active",
"synonyms": [ "synonyms": [
"Blaze EK", "Blaze EK",
"Neptune EK" "Neptune EK"
], ]
"status": "Active"
}, },
"uuid": "f15f9264-854e-4e25-8641-cde2faeb86e9" "uuid": "f15f9264-854e-4e25-8641-cde2faeb86e9",
"value": "Terror EK"
}, },
{ {
"value": "DealersChoice",
"description": "DealersChoice is a Flash Player Exploit platform triggered by RTF.\n\nDealersChoice is a platform that generates malicious documents containing embedded Adobe Flash files. Palo Alto Network researchers analyzed two variants — variant A, which is a standalone variant including Flash exploit code packaged with a payload, and variant B, which is a modular variant that loads exploit code on demand. This new component appeared in 2016 and is still in use.", "description": "DealersChoice is a Flash Player Exploit platform triggered by RTF.\n\nDealersChoice is a platform that generates malicious documents containing embedded Adobe Flash files. Palo Alto Network researchers analyzed two variants — variant A, which is a standalone variant including Flash exploit code packaged with a payload, and variant B, which is a modular variant that loads exploit code on demand. This new component appeared in 2016 and is still in use.",
"meta": { "meta": {
"refs": [ "refs": [
@ -47,30 +56,30 @@
"http://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-ramps-up-spear-phishing-before-zero-days-get-patched/", "http://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-ramps-up-spear-phishing-before-zero-days-get-patched/",
"https://www.welivesecurity.com/2017/12/21/sednit-update-fancy-bear-spent-year/" "https://www.welivesecurity.com/2017/12/21/sednit-update-fancy-bear-spent-year/"
], ],
"status": "Active",
"synonyms": [ "synonyms": [
"Sednit RTF EK" "Sednit RTF EK"
], ]
"status": "Active"
}, },
"uuid": "0f116533-a755-4cfc-815a-fa6bcb85efb7" "uuid": "0f116533-a755-4cfc-815a-fa6bcb85efb7",
"value": "DealersChoice"
}, },
{ {
"value": "DNSChanger",
"description": "DNSChanger Exploit Kit is an exploit kit targeting Routers via the browser", "description": "DNSChanger Exploit Kit is an exploit kit targeting Routers via the browser",
"meta": { "meta": {
"refs": [ "refs": [
"http://malware.dontneedcoffee.com/2015/05/an-exploit-kit-dedicated-to-csrf.html", "http://malware.dontneedcoffee.com/2015/05/an-exploit-kit-dedicated-to-csrf.html",
"https://www.proofpoint.com/us/threat-insight/post/home-routers-under-attack-malvertising-windows-android-devices" "https://www.proofpoint.com/us/threat-insight/post/home-routers-under-attack-malvertising-windows-android-devices"
], ],
"status": "Active",
"synonyms": [ "synonyms": [
"RouterEK" "RouterEK"
], ]
"status": "Active"
}, },
"uuid": "74fb6a14-1279-4a5b-939a-76478d36d3e1" "uuid": "74fb6a14-1279-4a5b-939a-76478d36d3e1",
"value": "DNSChanger"
}, },
{ {
"value": "Disdain",
"description": "Disdain EK has been introduced on underground forum on 2017-08-07. The panel is stolen from Sundown, the pattern are Terror alike and the obfuscation reminds Nebula", "description": "Disdain EK has been introduced on underground forum on 2017-08-07. The panel is stolen from Sundown, the pattern are Terror alike and the obfuscation reminds Nebula",
"meta": { "meta": {
"refs": [ "refs": [
@ -78,25 +87,25 @@
], ],
"status": "Active" "status": "Active"
}, },
"uuid": "1ded776d-6772-4cc8-a27f-f61e24a58d96" "uuid": "1ded776d-6772-4cc8-a27f-f61e24a58d96",
"value": "Disdain"
}, },
{ {
"value": "Kaixin",
"description": "Kaixin is an exploit kit mainly seen behind compromised website in Asia", "description": "Kaixin is an exploit kit mainly seen behind compromised website in Asia",
"meta": { "meta": {
"refs": [ "refs": [
"http://www.kahusecurity.com/2013/deobfuscating-the-ck-exploit-kit/", "http://www.kahusecurity.com/2013/deobfuscating-the-ck-exploit-kit/",
"http://www.kahusecurity.com/2012/new-chinese-exploit-pack/" "http://www.kahusecurity.com/2012/new-chinese-exploit-pack/"
], ],
"status": "Active",
"synonyms": [ "synonyms": [
"CK vip" "CK vip"
], ]
"status": "Active"
}, },
"uuid": "e6c1cfcf-3e37-4f5a-9494-989dd8c43d88" "uuid": "e6c1cfcf-3e37-4f5a-9494-989dd8c43d88",
"value": "Kaixin"
}, },
{ {
"value": "Magnitude",
"description": "Magnitude EK", "description": "Magnitude EK",
"meta": { "meta": {
"refs": [ "refs": [
@ -105,16 +114,16 @@
"http://malware.dontneedcoffee.com/2014/02/and-real-name-of-magnitude-is.html", "http://malware.dontneedcoffee.com/2014/02/and-real-name-of-magnitude-is.html",
"https://community.rsa.com/community/products/netwitness/blog/2017/02/09/magnitude-exploit-kit-under-the-hood" "https://community.rsa.com/community/products/netwitness/blog/2017/02/09/magnitude-exploit-kit-under-the-hood"
], ],
"status": "Active",
"synonyms": [ "synonyms": [
"Popads EK", "Popads EK",
"TopExp" "TopExp"
], ]
"status": "Active"
}, },
"uuid": "6a313e11-5bb2-40ed-8cde-9de768b783b1" "uuid": "6a313e11-5bb2-40ed-8cde-9de768b783b1",
"value": "Magnitude"
}, },
{ {
"value": "MWI",
"description": "Microsoft Word Intruder is an exploit kit focused on Word and embedded flash exploits. The author wants to avoid their customer to use it in mass spam campaign, so it's most often connected to semi-targeted attacks", "description": "Microsoft Word Intruder is an exploit kit focused on Word and embedded flash exploits. The author wants to avoid their customer to use it in mass spam campaign, so it's most often connected to semi-targeted attacks",
"meta": { "meta": {
"refs": [ "refs": [
@ -123,10 +132,10 @@
], ],
"status": "Active" "status": "Active"
}, },
"uuid": "489acbf2-d80b-4bb5-ac7d-c8573dcb6324" "uuid": "489acbf2-d80b-4bb5-ac7d-c8573dcb6324",
"value": "MWI"
}, },
{ {
"value": "ThreadKit",
"description": "ThreadKit is the name given to a widely used Microsoft Office document exploit builder kit that appeared in June 2017", "description": "ThreadKit is the name given to a widely used Microsoft Office document exploit builder kit that appeared in June 2017",
"meta": { "meta": {
"refs": [ "refs": [
@ -134,10 +143,10 @@
], ],
"status": "Active" "status": "Active"
}, },
"uuid": "b8be783c-69a8-11e8-adc0-fa7ae01bbebc" "uuid": "b8be783c-69a8-11e8-adc0-fa7ae01bbebc",
"value": "ThreadKit"
}, },
{ {
"value": "VenomKit",
"description": "VenomKit is the name given to a kit sold since april 2017 as \"Word 1day exploit builder\" by user badbullzvenom. Author allows only use in targeted campaign. Is used for instance by the \"Cobalt Gang\"", "description": "VenomKit is the name given to a kit sold since april 2017 as \"Word 1day exploit builder\" by user badbullzvenom. Author allows only use in targeted campaign. Is used for instance by the \"Cobalt Gang\"",
"meta": { "meta": {
"refs": [ "refs": [
@ -145,10 +154,10 @@
], ],
"status": "Active" "status": "Active"
}, },
"uuid": "b8be7af8-69a8-11e8-adc0-fa7ae01bbebc" "uuid": "b8be7af8-69a8-11e8-adc0-fa7ae01bbebc",
"value": "VenomKit"
}, },
{ {
"value": "RIG",
"description": "RIG is an exploit kit that takes its source in Infinity EK itself an evolution of Redkit. It became dominant after the fall of Angler, Nuclear Pack and the end of public access to Neutrino. RIG-v is the name given to RIG 4 when it was only accessible by \"vip\" customers and when RIG 3 was still in use.", "description": "RIG is an exploit kit that takes its source in Infinity EK itself an evolution of Redkit. It became dominant after the fall of Angler, Nuclear Pack and the end of public access to Neutrino. RIG-v is the name given to RIG 4 when it was only accessible by \"vip\" customers and when RIG 3 was still in use.",
"meta": { "meta": {
"refs": [ "refs": [
@ -157,91 +166,107 @@
"https://www.trustwave.com/Resources/SpiderLabs-Blog/RIG-Exploit-Kit-%E2%80%93-Diving-Deeper-into-the-Infrastructure/", "https://www.trustwave.com/Resources/SpiderLabs-Blog/RIG-Exploit-Kit-%E2%80%93-Diving-Deeper-into-the-Infrastructure/",
"http://malware.dontneedcoffee.com/2016/10/rig-evolves-neutrino-waves-goodbye.html" "http://malware.dontneedcoffee.com/2016/10/rig-evolves-neutrino-waves-goodbye.html"
], ],
"status": "Active",
"synonyms": [ "synonyms": [
"RIG 3", "RIG 3",
"RIG-v", "RIG-v",
"RIG 4", "RIG 4",
"Meadgive" "Meadgive"
], ]
"status": "Active"
}, },
"uuid": "0545e5c0-ed0d-4a02-a69d-31e9e2b31e8a" "uuid": "0545e5c0-ed0d-4a02-a69d-31e9e2b31e8a",
"value": "RIG"
}, },
{ {
"value": "Sednit EK",
"description": "Sednit EK is the exploit kit used by APT28", "description": "Sednit EK is the exploit kit used by APT28",
"meta": { "meta": {
"refs": [ "refs": [
"http://www.welivesecurity.com/2014/10/08/sednit-espionage-group-now-using-custom-exploit-kit/", "http://www.welivesecurity.com/2014/10/08/sednit-espionage-group-now-using-custom-exploit-kit/",
"http://blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-flash-zero-day-used-in-pawn-storm-campaign/" "http://blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-flash-zero-day-used-in-pawn-storm-campaign/"
], ],
"status": "Active",
"synonyms": [ "synonyms": [
"SedKit" "SedKit"
], ]
"status": "Active"
}, },
"uuid": "c8b9578a-78be-420c-a29b-9214d09685c8" "uuid": "c8b9578a-78be-420c-a29b-9214d09685c8",
"value": "Sednit EK"
}, },
{ {
"value": "Sundown-P",
"description": "Sundown-P/Sundown-Pirate is a rip of Sundown seen used in a private way (One group using it only) - First spotted at the end of June 2017, branded as CaptainBlack in August 2017", "description": "Sundown-P/Sundown-Pirate is a rip of Sundown seen used in a private way (One group using it only) - First spotted at the end of June 2017, branded as CaptainBlack in August 2017",
"meta": { "meta": {
"refs": [ "refs": [
"http://blog.trendmicro.com/trendlabs-security-intelligence/promediads-malvertising-sundown-pirate-exploit-kit/" "http://blog.trendmicro.com/trendlabs-security-intelligence/promediads-malvertising-sundown-pirate-exploit-kit/"
], ],
"status": "Active",
"synonyms": [ "synonyms": [
"Sundown-Pirate", "Sundown-Pirate",
"CaptainBlack" "CaptainBlack"
], ]
"status": "Active"
}, },
"uuid": "3235ae90-598b-45dc-b336-852817b271a8" "uuid": "3235ae90-598b-45dc-b336-852817b271a8",
"value": "Sundown-P"
}, },
{ {
"value": "Bizarro Sundown",
"description": "Bizarro Sundown appears to be a fork of Sundown with added anti-analysis features", "description": "Bizarro Sundown appears to be a fork of Sundown with added anti-analysis features",
"meta": { "meta": {
"refs": [ "refs": [
"http://blog.trendmicro.com/trendlabs-security-intelligence/new-bizarro-sundown-exploit-kit-spreads-locky/", "http://blog.trendmicro.com/trendlabs-security-intelligence/new-bizarro-sundown-exploit-kit-spreads-locky/",
"https://blog.malwarebytes.com/cybercrime/exploits/2016/10/yet-another-sundown-ek-variant/" "https://blog.malwarebytes.com/cybercrime/exploits/2016/10/yet-another-sundown-ek-variant/"
], ],
"status": "Retired",
"synonyms": [ "synonyms": [
"Sundown-b" "Sundown-b"
], ]
"status": "Retired"
}, },
"uuid": "ef3b170e-3fbe-420b-b202-4689da137c50" "uuid": "ef3b170e-3fbe-420b-b202-4689da137c50",
"value": "Bizarro Sundown"
}, },
{ {
"value": "Hunter",
"description": "Hunter EK is an evolution of 3Ros EK", "description": "Hunter EK is an evolution of 3Ros EK",
"meta": { "meta": {
"refs": [ "refs": [
"https://www.proofpoint.com/us/threat-insight/post/Hunter-Exploit-Kit-Targets-Brazilian-Banking-Customers" "https://www.proofpoint.com/us/threat-insight/post/Hunter-Exploit-Kit-Targets-Brazilian-Banking-Customers"
], ],
"status": "Retired - Last seen 2017-02-06",
"synonyms": [ "synonyms": [
"3ROS Exploit Kit" "3ROS Exploit Kit"
], ]
"status": "Retired - Last seen 2017-02-06"
}, },
"uuid": "96b2b31e-b191-43c4-9929-48ba1cbee62c" "related": [
{
"dest-uuid": "75f53ead-1aee-4f91-8cb9-b4170d747cfc",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "5594b171-32ec-4145-b712-e7701effffdd",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
}
],
"uuid": "96b2b31e-b191-43c4-9929-48ba1cbee62c",
"value": "Hunter"
}, },
{ {
"value": "GreenFlash Sundown",
"description": "GreenFlash Sundown is a variation of Bizarro Sundown without landing", "description": "GreenFlash Sundown is a variation of Bizarro Sundown without landing",
"meta": { "meta": {
"refs": [ "refs": [
"http://blog.trendmicro.com/trendlabs-security-intelligence/new-bizarro-sundown-exploit-kit-spreads-locky/" "http://blog.trendmicro.com/trendlabs-security-intelligence/new-bizarro-sundown-exploit-kit-spreads-locky/"
], ],
"status": "Active",
"synonyms": [ "synonyms": [
"Sundown-GF" "Sundown-GF"
], ]
"status": "Active"
}, },
"uuid": "6e5c0dbb-fb0b-45ea-ac6c-bb6d8324bbd2" "uuid": "6e5c0dbb-fb0b-45ea-ac6c-bb6d8324bbd2",
"value": "GreenFlash Sundown"
}, },
{ {
"value": "Angler",
"description": "The Angler Exploit Kit has been the most popular and evolved exploit kit from 2014 to middle of 2016. There was several variation. The historical \"indexm\" variant was used to spread Lurk. A vip version used notabily to spread Poweliks, the \"standard\" commercial version, and a declinaison tied to load selling (mostly bankers) that can be associated to EmpirePPC", "description": "The Angler Exploit Kit has been the most popular and evolved exploit kit from 2014 to middle of 2016. There was several variation. The historical \"indexm\" variant was used to spread Lurk. A vip version used notabily to spread Poweliks, the \"standard\" commercial version, and a declinaison tied to load selling (mostly bankers) that can be associated to EmpirePPC",
"meta": { "meta": {
"refs": [ "refs": [
@ -249,17 +274,17 @@
"http://malware.dontneedcoffee.com/2015/12/xxx-is-angler-ek.html", "http://malware.dontneedcoffee.com/2015/12/xxx-is-angler-ek.html",
"http://malware.dontneedcoffee.com/2016/06/is-it-end-of-angler.html" "http://malware.dontneedcoffee.com/2016/06/is-it-end-of-angler.html"
], ],
"status": "Retired - Last seen: 2016-06-07",
"synonyms": [ "synonyms": [
"XXX", "XXX",
"AEK", "AEK",
"Axpergle" "Axpergle"
], ]
"status": "Retired - Last seen: 2016-06-07"
}, },
"uuid": "5daf41c7-b297-4228-85d1-eb040d5b7c90" "uuid": "5daf41c7-b297-4228-85d1-eb040d5b7c90",
"value": "Angler"
}, },
{ {
"value": "Archie",
"description": "Archie EK", "description": "Archie EK",
"meta": { "meta": {
"refs": [ "refs": [
@ -267,41 +292,50 @@
], ],
"status": "Retired" "status": "Retired"
}, },
"uuid": "2756caae-d2c5-4170-9e76-2b7f1b1fccb1" "uuid": "2756caae-d2c5-4170-9e76-2b7f1b1fccb1",
"value": "Archie"
}, },
{ {
"value": "BlackHole",
"description": "The BlackHole Exploit Kit has been the most popular exploit kit from 2011 to 2013. Its activity stopped with Paunch's arrest (all activity since then is anecdotal and based on an old leak)", "description": "The BlackHole Exploit Kit has been the most popular exploit kit from 2011 to 2013. Its activity stopped with Paunch's arrest (all activity since then is anecdotal and based on an old leak)",
"meta": { "meta": {
"refs": [ "refs": [
"https://www.trustwave.com/Resources/SpiderLabs-Blog/Blackhole-Exploit-Kit-v2/", "https://www.trustwave.com/Resources/SpiderLabs-Blog/Blackhole-Exploit-Kit-v2/",
"https://nakedsecurity.sophos.com/exploring-the-blackhole-exploit-kit/" "https://nakedsecurity.sophos.com/exploring-the-blackhole-exploit-kit/"
], ],
"status": "Retired - Last seen: 2013-10-07",
"synonyms": [ "synonyms": [
"BHEK" "BHEK"
], ]
"status": "Retired - Last seen: 2013-10-07"
}, },
"uuid": "e6201dc3-01a7-40c5-ba72-02fa470ada53" "related": [
{
"dest-uuid": "2ea1f494-cf18-49fb-a043-36555131dd7c",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
}
],
"uuid": "e6201dc3-01a7-40c5-ba72-02fa470ada53",
"value": "BlackHole"
}, },
{ {
"value": "Bleeding Life",
"description": "Bleeding Life is an exploit kit that became open source with its version 2", "description": "Bleeding Life is an exploit kit that became open source with its version 2",
"meta": { "meta": {
"refs": [ "refs": [
"http://www.kahusecurity.com/2011/flash-used-in-idol-malvertisement/", "http://www.kahusecurity.com/2011/flash-used-in-idol-malvertisement/",
"http://thehackernews.com/2011/10/bleeding-life-2-exploit-pack-released.html" "http://thehackernews.com/2011/10/bleeding-life-2-exploit-pack-released.html"
], ],
"status": "Retired",
"synonyms": [ "synonyms": [
"BL", "BL",
"BL2" "BL2"
], ]
"status": "Retired"
}, },
"uuid": "5abe6240-dce2-4455-8125-ddae2e651243" "uuid": "5abe6240-dce2-4455-8125-ddae2e651243",
"value": "Bleeding Life"
}, },
{ {
"value": "Cool",
"description": "The Cool Exploit Kit was a kind of BlackHole VIP in 2012/2013", "description": "The Cool Exploit Kit was a kind of BlackHole VIP in 2012/2013",
"meta": { "meta": {
"refs": [ "refs": [
@ -309,75 +343,84 @@
"http://malware.dontneedcoffee.com/2013/07/a-styxy-cool-ek.html", "http://malware.dontneedcoffee.com/2013/07/a-styxy-cool-ek.html",
"http://blog.trendmicro.com/trendlabs-security-intelligence/styx-exploit-pack-how-it-works/" "http://blog.trendmicro.com/trendlabs-security-intelligence/styx-exploit-pack-how-it-works/"
], ],
"status": "Retired - Last seen: 2013-10-07",
"synonyms": [ "synonyms": [
"CEK", "CEK",
"Styxy Cool" "Styxy Cool"
], ]
"status": "Retired - Last seen: 2013-10-07"
}, },
"uuid": "9bb229b0-80f9-48e5-b8fb-00ee7af070cb" "uuid": "9bb229b0-80f9-48e5-b8fb-00ee7af070cb",
"value": "Cool"
}, },
{ {
"value": "Fiesta",
"description": "Fiesta Exploit Kit", "description": "Fiesta Exploit Kit",
"meta": { "meta": {
"refs": [ "refs": [
"http://blog.0x3a.com/post/110052845124/an-in-depth-analysis-of-the-fiesta-exploit-kit-an", "http://blog.0x3a.com/post/110052845124/an-in-depth-analysis-of-the-fiesta-exploit-kit-an",
"http://www.kahusecurity.com/2011/neosploit-is-back/" "http://www.kahusecurity.com/2011/neosploit-is-back/"
], ],
"status": "Retired - Last Seen: beginning of 2015-07",
"synonyms": [ "synonyms": [
"NeoSploit", "NeoSploit",
"Fiexp" "Fiexp"
], ]
"status": "Retired - Last Seen: beginning of 2015-07"
}, },
"uuid": "f50f860a-d795-4f4e-a170-8190f65499ad" "uuid": "f50f860a-d795-4f4e-a170-8190f65499ad",
"value": "Fiesta"
}, },
{ {
"value": "Empire",
"description": "The Empire Pack is a variation of RIG operated by a load seller. It's being fed by many traffic actors", "description": "The Empire Pack is a variation of RIG operated by a load seller. It's being fed by many traffic actors",
"meta": { "meta": {
"refs": [ "refs": [
"http://malware.dontneedcoffee.com/2016/10/rig-evolves-neutrino-waves-goodbye.html" "http://malware.dontneedcoffee.com/2016/10/rig-evolves-neutrino-waves-goodbye.html"
], ],
"status": "Retired - Last seen: 2016-12-29",
"synonyms": [ "synonyms": [
"RIG-E" "RIG-E"
], ]
"status": "Retired - Last seen: 2016-12-29"
}, },
"uuid": "6eb15569-4ddd-4820-9a44-7bca5b303b86" "related": [
{
"dest-uuid": "525ce93a-76a1-441a-9c45-0eac64d0ed12",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
}
],
"uuid": "6eb15569-4ddd-4820-9a44-7bca5b303b86",
"value": "Empire"
}, },
{ {
"value": "FlashPack",
"description": "FlashPack EK got multiple fork. The most common variant seen was the standalone Flash version", "description": "FlashPack EK got multiple fork. The most common variant seen was the standalone Flash version",
"meta": { "meta": {
"refs": [ "refs": [
"http://malware.dontneedcoffee.com/2012/11/meet-critxpack-previously-vintage-pack.html", "http://malware.dontneedcoffee.com/2012/11/meet-critxpack-previously-vintage-pack.html",
"http://malware.dontneedcoffee.com/2013/04/meet-safe-pack-v20-again.html" "http://malware.dontneedcoffee.com/2013/04/meet-safe-pack-v20-again.html"
], ],
"status": "Retired - Last seen: middle of 2015-04",
"synonyms": [ "synonyms": [
"FlashEK", "FlashEK",
"SafePack", "SafePack",
"CritXPack", "CritXPack",
"Vintage Pack" "Vintage Pack"
], ]
"status": "Retired - Last seen: middle of 2015-04"
}, },
"uuid": "55a30ccc-8905-4af2-a498-5c0010815cc1" "uuid": "55a30ccc-8905-4af2-a498-5c0010815cc1",
}, "value": "FlashPack"
},
{ {
"value": "Glazunov",
"description": "Glazunov is an exploit kit mainly seen behind compromised website in 2012 and 2013. Glazunov compromission is likely the ancestor activity of what became EITest in July 2014. Sibhost and Flimkit later shown similarities with this Exploit Kit", "description": "Glazunov is an exploit kit mainly seen behind compromised website in 2012 and 2013. Glazunov compromission is likely the ancestor activity of what became EITest in July 2014. Sibhost and Flimkit later shown similarities with this Exploit Kit",
"meta": { "meta": {
"refs": [ "refs": [
"https://nakedsecurity.sophos.com/2013/06/24/taking-a-closer-look-at-the-glazunov-exploit-kit/" "https://nakedsecurity.sophos.com/2013/06/24/taking-a-closer-look-at-the-glazunov-exploit-kit/"
], ],
"status": "Retired - Last seen: maybe end of 2013" "status": "Retired - Last seen: maybe end of 2013"
}, },
"uuid": "897374fa-6a35-11e8-adc0-fa7ae01bbebc" "uuid": "897374fa-6a35-11e8-adc0-fa7ae01bbebc",
}, "value": "Glazunov"
},
{ {
"value": "GrandSoft",
"description": "GrandSoft Exploit Kit was a quite common exploit kit used in 2012/2013. Disappeared between march 2014 and September 2017", "description": "GrandSoft Exploit Kit was a quite common exploit kit used in 2012/2013. Disappeared between march 2014 and September 2017",
"meta": { "meta": {
"refs": [ "refs": [
@ -385,16 +428,16 @@
"http://malware.dontneedcoffee.com/2012/10/neosploit-now-showing-bh-ek-20-like.html", "http://malware.dontneedcoffee.com/2012/10/neosploit-now-showing-bh-ek-20-like.html",
"https://nakedsecurity.sophos.com/2012/08/24/sophos-sucks-malware/" "https://nakedsecurity.sophos.com/2012/08/24/sophos-sucks-malware/"
], ],
"status": "Active",
"synonyms": [ "synonyms": [
"StampEK", "StampEK",
"SofosFO" "SofosFO"
], ]
"status": "Active"
}, },
"uuid": "180b6969-2aca-4642-b684-b57db8f0eff8" "uuid": "180b6969-2aca-4642-b684-b57db8f0eff8",
"value": "GrandSoft"
}, },
{ {
"value": "HanJuan",
"description": "Hanjuan EK was a one actor fed variation of Angler EK used in evolved malvertising chain targeting USA. It has been using a 0day (CVE-2015-0313) from beginning of December 2014 till beginning of February 2015", "description": "Hanjuan EK was a one actor fed variation of Angler EK used in evolved malvertising chain targeting USA. It has been using a 0day (CVE-2015-0313) from beginning of December 2014 till beginning of February 2015",
"meta": { "meta": {
"refs": [ "refs": [
@ -405,24 +448,24 @@
], ],
"status": "Retired - Last seen: 2015-07" "status": "Retired - Last seen: 2015-07"
}, },
"uuid": "886abdc6-db1a-4fc5-afe0-e17d65a83614" "uuid": "886abdc6-db1a-4fc5-afe0-e17d65a83614",
"value": "HanJuan"
}, },
{ {
"value": "Himan",
"description": "Himan Exploit Kit", "description": "Himan Exploit Kit",
"meta": { "meta": {
"refs": [ "refs": [
"http://malware.dontneedcoffee.com/2013/10/HiMan.html" "http://malware.dontneedcoffee.com/2013/10/HiMan.html"
], ],
"status": "Retired - Last seen: 2014-04",
"synonyms": [ "synonyms": [
"High Load" "High Load"
], ]
"status": "Retired - Last seen: 2014-04"
}, },
"uuid": "3d0cb558-7f04-4be8-963e-5f137566b07b" "uuid": "3d0cb558-7f04-4be8-963e-5f137566b07b",
"value": "Himan"
}, },
{ {
"value": "Impact",
"description": "Impact EK", "description": "Impact EK",
"meta": { "meta": {
"refs": [ "refs": [
@ -430,26 +473,26 @@
], ],
"status": "Retired" "status": "Retired"
}, },
"uuid": "319357b4-3041-4a71-89c5-51be08041d1b" "uuid": "319357b4-3041-4a71-89c5-51be08041d1b",
"value": "Impact"
}, },
{ {
"value": "Infinity",
"description": "Infinity is an evolution of Redkit", "description": "Infinity is an evolution of Redkit",
"meta": { "meta": {
"refs": [ "refs": [
"http://blog.talosintel.com/2013/11/im-calling-this-goon-exploit-kit-for-now.html", "http://blog.talosintel.com/2013/11/im-calling-this-goon-exploit-kit-for-now.html",
"http://www.kahusecurity.com/2014/the-resurrection-of-redkit/" "http://www.kahusecurity.com/2014/the-resurrection-of-redkit/"
], ],
"status": "Retired - Last seen: 2014-07",
"synonyms": [ "synonyms": [
"Redkit v2.0", "Redkit v2.0",
"Goon" "Goon"
], ]
"status": "Retired - Last seen: 2014-07"
}, },
"uuid": "4b858835-7b31-4b94-8144-b5175da1551f" "uuid": "4b858835-7b31-4b94-8144-b5175da1551f",
"value": "Infinity"
}, },
{ {
"value": "Lightsout",
"description": "Lightsout Exploit Kit has been used in Watering Hole attack performed by the APT Group havex", "description": "Lightsout Exploit Kit has been used in Watering Hole attack performed by the APT Group havex",
"meta": { "meta": {
"refs": [ "refs": [
@ -459,10 +502,10 @@
], ],
"status": "Unknown - Last seen: 2014-03" "status": "Unknown - Last seen: 2014-03"
}, },
"uuid": "244c05f8-1a2f-47fb-9dcf-2eaa99ab6aa1" "uuid": "244c05f8-1a2f-47fb-9dcf-2eaa99ab6aa1",
"value": "Lightsout"
}, },
{ {
"value": "Nebula",
"description": "Nebula Exploit Kit has been built on Sundown source and features an internal TDS", "description": "Nebula Exploit Kit has been built on Sundown source and features an internal TDS",
"meta": { "meta": {
"refs": [ "refs": [
@ -470,89 +513,89 @@
], ],
"status": "Retired - Last seen 2017-03-09" "status": "Retired - Last seen 2017-03-09"
}, },
"uuid": "4ca96067-8fdd-4b48-bd34-d2e175e27bad" "uuid": "4ca96067-8fdd-4b48-bd34-d2e175e27bad",
"value": "Nebula"
}, },
{ {
"value": "Neutrino",
"description": "Neutrino Exploit Kit has been one of the major exploit kit from its launch in 2013 till september 2016 when it become private (defense name for this variation is Neutrino-v). This EK vanished from march 2014 till november 2014.", "description": "Neutrino Exploit Kit has been one of the major exploit kit from its launch in 2013 till september 2016 when it become private (defense name for this variation is Neutrino-v). This EK vanished from march 2014 till november 2014.",
"meta": { "meta": {
"refs": [ "refs": [
"http://malware.dontneedcoffee.com/2013/03/hello-neutrino-just-one-more-exploit-kit.html", "http://malware.dontneedcoffee.com/2013/03/hello-neutrino-just-one-more-exploit-kit.html",
"http://malware.dontneedcoffee.com/2014/11/neutrino-come-back.html" "http://malware.dontneedcoffee.com/2014/11/neutrino-come-back.html"
], ],
"status": "Retired - Last seen 2017-04-10",
"synonyms": [ "synonyms": [
"Job314", "Job314",
"Neutrino Rebooted", "Neutrino Rebooted",
"Neutrino-v" "Neutrino-v"
], ]
"status": "Retired - Last seen 2017-04-10"
}, },
"uuid": "218ae39b-2f92-4355-91c6-50cce319d26d" "uuid": "218ae39b-2f92-4355-91c6-50cce319d26d",
"value": "Neutrino"
}, },
{ {
"value": "Niteris",
"description": "Niteris was used mainly to target Russian.", "description": "Niteris was used mainly to target Russian.",
"meta": { "meta": {
"refs": [ "refs": [
"http://malware.dontneedcoffee.com/2014/06/cottoncastle.html", "http://malware.dontneedcoffee.com/2014/06/cottoncastle.html",
"http://malware.dontneedcoffee.com/2015/05/another-look-at-niteris-post.html" "http://malware.dontneedcoffee.com/2015/05/another-look-at-niteris-post.html"
], ],
"status": "Unknown - Last seen: 2015-11",
"synonyms": [ "synonyms": [
"CottonCastle" "CottonCastle"
], ]
"status": "Unknown - Last seen: 2015-11"
}, },
"uuid": "b344133f-e223-4fda-8fb2-88ad7999e549" "uuid": "b344133f-e223-4fda-8fb2-88ad7999e549",
"value": "Niteris"
}, },
{ {
"value": "Nuclear",
"description": "The Nuclear Pack appeared in 2009 and has been one of the longer living one. Spartan EK was a landing less variation of Nuclear Pack", "description": "The Nuclear Pack appeared in 2009 and has been one of the longer living one. Spartan EK was a landing less variation of Nuclear Pack",
"meta": { "meta": {
"refs": [ "refs": [
"http://blog.checkpoint.com/2016/05/17/inside-nuclears-core-unraveling-a-ransomware-as-a-service-infrastructure/" "http://blog.checkpoint.com/2016/05/17/inside-nuclears-core-unraveling-a-ransomware-as-a-service-infrastructure/"
], ],
"status": "Retired - Last seen: 2015-04-30",
"synonyms": [ "synonyms": [
"NEK", "NEK",
"Nuclear Pack", "Nuclear Pack",
"Spartan", "Spartan",
"Neclu" "Neclu"
], ]
"status": "Retired - Last seen: 2015-04-30"
}, },
"uuid": "e7c516f9-5222-4f0d-b80b-ae9f4c24583d" "uuid": "e7c516f9-5222-4f0d-b80b-ae9f4c24583d",
"value": "Nuclear"
}, },
{ {
"value": "Phoenix",
"description": "Phoenix Exploit Kit", "description": "Phoenix Exploit Kit",
"meta": { "meta": {
"refs": [ "refs": [
"http://malwareint.blogspot.fr/2010/09/phoenix-exploits-kit-v21-inside.html", "http://malwareint.blogspot.fr/2010/09/phoenix-exploits-kit-v21-inside.html",
"http://blog.trendmicro.com/trendlabs-security-intelligence/now-exploiting-phoenix-exploit-kit-version-2-5/" "http://blog.trendmicro.com/trendlabs-security-intelligence/now-exploiting-phoenix-exploit-kit-version-2-5/"
], ],
"status": "Retired",
"synonyms": [ "synonyms": [
"PEK" "PEK"
], ]
"status": "Retired"
}, },
"uuid": "0df2c7a6-046f-4489-8c77-0999c92c839d" "uuid": "0df2c7a6-046f-4489-8c77-0999c92c839d",
"value": "Phoenix"
}, },
{ {
"value": "Private Exploit Pack",
"description": "Private Exploit Pack", "description": "Private Exploit Pack",
"meta": { "meta": {
"refs": [ "refs": [
"http://malware.dontneedcoffee.com/2013/07/pep-new-bep.html", "http://malware.dontneedcoffee.com/2013/07/pep-new-bep.html",
"http://malwageddon.blogspot.fr/2013/07/unknown-ek-well-hey-hey-i-wanna-be.html" "http://malwageddon.blogspot.fr/2013/07/unknown-ek-well-hey-hey-i-wanna-be.html"
], ],
"status": "Retired",
"synonyms": [ "synonyms": [
"PEP" "PEP"
], ]
"status": "Retired"
}, },
"uuid": "cfd0a4af-f559-496f-b56b-97145ea4e4c3" "uuid": "cfd0a4af-f559-496f-b56b-97145ea4e4c3",
"value": "Private Exploit Pack"
}, },
{ {
"value": "Redkit",
"description": "Redkit has been a major exploit kit in 2012. One of its specific features was to allow its access against a share of a percentage of the customer's traffic", "description": "Redkit has been a major exploit kit in 2012. One of its specific features was to allow its access against a share of a percentage of the customer's traffic",
"meta": { "meta": {
"refs": [ "refs": [
@ -562,10 +605,10 @@
], ],
"status": "Retired" "status": "Retired"
}, },
"uuid": "6958ff90-75e8-47ee-ab07-daa8d487130c" "uuid": "6958ff90-75e8-47ee-ab07-daa8d487130c",
"value": "Redkit"
}, },
{ {
"value": "Sakura",
"description": "Sakura Exploit Kit appeared in 2012 and was adopted by several big actor", "description": "Sakura Exploit Kit appeared in 2012 and was adopted by several big actor",
"meta": { "meta": {
"refs": [ "refs": [
@ -573,10 +616,10 @@
], ],
"status": "Retired - Last seen: 2013-09" "status": "Retired - Last seen: 2013-09"
}, },
"uuid": "12af9112-3ac5-4422-858e-a22c293c6117" "uuid": "12af9112-3ac5-4422-858e-a22c293c6117",
"value": "Sakura"
}, },
{ {
"value": "SPL",
"description": "SPL exploit kit was mainly seen in 2012/2013 most often associated with ZeroAccess and Scareware/FakeAV", "description": "SPL exploit kit was mainly seen in 2012/2013 most often associated with ZeroAccess and Scareware/FakeAV",
"meta": { "meta": {
"refs": [ "refs": [
@ -589,43 +632,43 @@
"SPL2" "SPL2"
] ]
}, },
"uuid": "15936d30-c151-4051-835e-df327143ce76" "uuid": "15936d30-c151-4051-835e-df327143ce76",
"value": "SPL"
}, },
{ {
"value": "Sundown",
"description": "Sundown Exploit Kit is mainly built out of stolen code from other exploit kits", "description": "Sundown Exploit Kit is mainly built out of stolen code from other exploit kits",
"meta": { "meta": {
"colour": "#C03701",
"refs": [ "refs": [
"http://malware.dontneedcoffee.com/2015/06/fast-look-at-sundown-ek.html", "http://malware.dontneedcoffee.com/2015/06/fast-look-at-sundown-ek.html",
"https://www.virusbulletin.com/virusbulletin/2015/06/beta-exploit-pack-one-more-piece-crimeware-infection-road" "https://www.virusbulletin.com/virusbulletin/2015/06/beta-exploit-pack-one-more-piece-crimeware-infection-road"
], ],
"status": "Retired - Last seen 2017-03-08",
"synonyms": [ "synonyms": [
"Beps", "Beps",
"Xer", "Xer",
"Beta" "Beta"
], ]
"status": "Retired - Last seen 2017-03-08",
"colour": "#C03701"
}, },
"uuid": "670e28c4-001a-4ba4-b276-441620225123" "uuid": "670e28c4-001a-4ba4-b276-441620225123",
"value": "Sundown"
}, },
{ {
"value": "Sweet-Orange",
"description": "Sweet Orange", "description": "Sweet Orange",
"meta": { "meta": {
"refs": [ "refs": [
"http://malware.dontneedcoffee.com/2012/12/juice-sweet-orange-2012-12.html" "http://malware.dontneedcoffee.com/2012/12/juice-sweet-orange-2012-12.html"
], ],
"status": "Retired - Last seen: 2015-04-05",
"synonyms": [ "synonyms": [
"SWO", "SWO",
"Anogre" "Anogre"
], ]
"status": "Retired - Last seen: 2015-04-05"
}, },
"uuid": "222bc508-4d8d-4972-9cac-65192cfefd43" "uuid": "222bc508-4d8d-4972-9cac-65192cfefd43",
"value": "Sweet-Orange"
}, },
{ {
"value": "Styx",
"description": "Styx Exploit Kit", "description": "Styx Exploit Kit",
"meta": { "meta": {
"refs": [ "refs": [
@ -635,10 +678,10 @@
], ],
"status": "Retired - Last seen: 2014-06" "status": "Retired - Last seen: 2014-06"
}, },
"uuid": "006eaa87-e8a6-4808-93ff-302b52c628b0" "uuid": "006eaa87-e8a6-4808-93ff-302b52c628b0",
"value": "Styx"
}, },
{ {
"value": "WhiteHole",
"description": "WhiteHole Exploit Kit appeared in January 2013 in the tail of the CVE-2013-0422", "description": "WhiteHole Exploit Kit appeared in January 2013 in the tail of the CVE-2013-0422",
"meta": { "meta": {
"refs": [ "refs": [
@ -646,10 +689,10 @@
], ],
"status": "Retired - Last seen: 2013-12" "status": "Retired - Last seen: 2013-12"
}, },
"uuid": "570bc715-7fe8-430b-bd2e-5512c95f2370" "uuid": "570bc715-7fe8-430b-bd2e-5512c95f2370",
"value": "WhiteHole"
}, },
{ {
"value": "Unknown",
"description": "Unknown Exploit Kit. This is a place holder for any undocumented Exploit Kit. If you use this tag, we will be more than happy to give the associated EK a deep look.", "description": "Unknown Exploit Kit. This is a place holder for any undocumented Exploit Kit. If you use this tag, we will be more than happy to give the associated EK a deep look.",
"meta": { "meta": {
"refs": [ "refs": [
@ -658,18 +701,9 @@
"https://twitter.com/kahusecurity" "https://twitter.com/kahusecurity"
] ]
}, },
"uuid": "00815961-3249-4e2e-9421-bb57feb73bb2" "uuid": "00815961-3249-4e2e-9421-bb57feb73bb2",
"value": "Unknown"
} }
], ],
"version": 7, "version": 8
"uuid": "454f4e78-bd7c-11e6-a4a6-cec0c932ce01",
"description": "Exploit-Kit is an enumeration of some exploitation kits used by adversaries. The list includes document, browser and router exploit kits.It's not meant to be totally exhaustive but aim at covering the most seen in the past 5 years",
"authors": [
"Kafeine",
"Will Metcalf",
"KahuSecurity"
],
"source": "MISP Project",
"type": "exploit-kit",
"name": "Exploit-Kit"
} }