Check Point Software Technologies Ltd. has revealed a massive uplift in Exploit Kit usage by cybercriminals worldwide, with Rig making its way onto the list of top ten threats in Kenya and Nigeria according to the company’s March Global Threat Impact Index.
Exploit Kits, which are designed to discover and exploit vulnerabilities on machines in order to download and execute further malicious code, have been in decline since a high point in May 2016, following the demise of the leading Angler and Nuclear variants. However, March saw the Rig EK surge up the rankings, being the second most-used malware worldwide throughout the period. The Terror Exploit Kit also increased dramatically in usage in March, and was just one place from making it into the monthly top ten list.
Rig delivers exploits for Flash, Java, Silverlight and Internet Explorer. The infection chain starts with a redirection to a landing page that contains JavaScript, which then checks for vulnerable plug-ins and delivers the exploit. Terror was first detected at the start of December 2016, and contained eight different operational exploits. Both Rig and Terror have been witnessed delivering a wide variety of threats, from ransomware and banking Trojans to spambots and BitCoin miners.
Ransomware proved one of the most profitable tools at cybercriminals’ disposal throughout 2016, and with popular Exploit Kits now being used to deliver it, the threat shows no sign of dying down. The fact that three African countries, including Zambia, Malawi and Uganda, are still in the top ten of Check Point’s Threat Index, which measures risk by country, is even greater cause for concern.
