The exploits of RIG EK are delivered to unsuspecting victims in two ways: either via malvertising, where users are redirected to online advertising pages that are tricked to execute the RIG exploits on their browser or when the victim visits sites that were compromised and the exploit kit’s JavaScript was injected.Īs Jérôme mentions, at Malwarebytes we've seen them involved via the same malvertising campaigns for the past several years.Ģ020 analysis of malvertising leading to the RIG Exploit Kit Prodaft researchers describe how they noticed RIG EK RIG dropping multiple types of malware, including stealers, Remote Access Trojans (RATs), cryptocurrency miners, and banking malware. RIG EK has also introduced some newer vulnerabilities while Internet Explorer's market share has continued to drop. It all depends on which cybercriminals pay the RIG EK administrator to install their malware on victim machines. Without many changes to the inner workings of the exploit kit itself, we've seen many changes in the malware distributed. RIG EK has been around since 2014 and, despite many take down efforts, has always managed to make a comeback. Ideally for the exploit kit handler, such attacks occur silently within seconds and they do not require any user interaction.Ī recent report by Prodaft details a wealth of information related to the victim statistics, operation, command and control (C&C) server, and technical aspects of RIG EK.

The primary infection method with an exploit kit is a drive-by download attack, when cybercriminals lure potential victims to a site where their browser can be fingerprinted and vulnerabilities can be unleashed to infect the system. We have observed RIG EK activity via the same malvertising campaigns for the past several years.”Īn exploit kit is a toolkit designed to facilitate the exploitation of client-side vulnerabilities most commonly found in browsers and their plugins in order to deliver malware. One major advantage for the malware distributors behind the exploit kit is that the outdated browser has reached end-of-life (EOL), which means it no longer receives security updates and patches against known threats.Īccording to Malwarebytes’ Senior Director of Threat Intelligence Jérôme Segura: “RIG EK is probably one of the last exploit kits targeting Internet Explorer still around. Despite a very slim browser market share, Internet Explorer (IE) is still being exploited by exploit kits like the RIG exploit kit (EK).

Malwarebytes free download for mac