Connect with our team of offensive security, AI security and pen testing experts at Black Hat Europe 2023. Learn More

Connect with our team of offensive security, AI security and pen testing experts at Black Hat Europe 2023. Learn More

Managed Detection & Response

Eradicate cyberthreats with world-class intel and expertise

Managed Security Services

Expand your team’s capabilities and strengthen your security posture

Consulting & Professional Services

Tap into our global team of tenured cybersecurity specialists

Penetration Testing

Subscription- or project-based testing, delivered by global experts

Database Security

Get ahead of database risk, protect data and exceed compliance requirements

Email Security & Management

Catch email threats others miss with layered security & maximum control

Co-Managed SOC (SIEM)

Eliminate alert fatigue, focus your SecOps team, stop threats fast, and reduce cyber risk

Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
The Trustwave Approach
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Platform
SpiderLabs Fusion Center
Security Operations Centers
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

Why Exploit Kits Are Going Dark

Three years ago, I devoted a blog post to the alarming uptick in exploit kit attacks, specifically due to Magnitude, which had recently gone on an unprecedented rampage in which it attempted to exploit 1.1 million machines over the course of a month, succeeding with about a hundred thousand. I even declared that "most of the attacks that occur on the web these days originate from these malicious toolkits."

How times have changed. Nowadays a glimpse into the exploit kit market may turn up more tumbleweeds than fraud. That's not to say the activity has completely dried up, but there is a noticeable shakeup and disappearance of major players. As the 2017 Trustwave Global Security Report noted: "The most common exploit kits in the world - Angler, Magnitude and Nuclear - disappeared or went private in 2016."

What the heck happened?

Experts point to a few reasons accounting for the fade of these crimeware packages, which come with pre-written code that automates the exploitation of client-side vulnerabilities, such as browser plug-ins, making it simple for even novice crooks to quietly deliver exploits and malware to unsuspecting users, usually via drive-by download attacks enabled through malicious advertisements.

1) Takedowns and Arrests

Cybercrime can be disrupted when forces unite - from researchers to law enforcement - to impede illegal operations. For example, many have attributed the disappearance of Nuclear, a longtime fixture on the exploit kit circuit, to a major technical analysis written about it in April 2016. That same month, "Paunch," the nicknamed author of the Blackhole exploit kit, was sentenced to seven years in prison. And a couple of months later, the popular Angler kit disappeared into the abyss, possibly related to the arrest of the so-called Lurk Trojan gang. Even RIG, arguably the largest beneficiary of the exploit market shakeup of 2016, has seen better days.

2) Software Makers Stepping Up

The No. 1 key to staying protected against exploit kits is keeping your patches up to date. There is no secret how important patching is, yet businesses still struggle with it due to the many roadblocks that stand in its way. Browser and software manufacturers like Adobe and Oracle have offered assistance by delivering more resilient products - and in some cases killing the biggest troublemakers, like Java and Flash. Other factors include improved browser security and the relative abandonment of Internet Explorer (IE), whose market share is plummeting and rendering the large stable of legacy IE bugs unusable.

3) Better Options for Cybercriminals

Cybercriminals are ever the profit-minded bunch. Not only are exploit kits facing resistance from the factors mentioned above, they also are expensive to operate and maintain. If kit developers believe the risk and cost of operating exploit kits is too burdensome, they will simply look elsewhere. And most are looking to spam and phishing to distribute malware and ransomware. The 2017 Trustwave Global Security Report found that 60 percent of all inbound email was spam in 2016, up from 54 percent in 2015, and the percentage of spam messages containing malware was 35 percent, up 3 percent. No surprise, then, that studies have found that nine out of every 10 breaches has a phishing or social engineering connection.


So, is it safe to assume we will never return to the earlier levels of exploit kit activity? That is virtually impossible to predict. But one thing we know for sure is that the era of exploit kits is not over. In fact, our SpiderLabs team recently reported on the "Terror" kit (despite it apparently being littered with programming errors), and RIG is responsible for a recent spate of compromised websites. The market is undoubtedly in flux, but criminals appear not ready to completely discard a revenue source, especially one as convenient as exploit kits, which typically are sold or rented to customers for sizable sums.

The good news is that the technical advice for protecting against exploit kits is like if the malware or ransomware attempted to infect your machines in some other way. Solutions, from the traditional like intrusion prevention systems and unified threat management, to the more advanced, like web security gateways and endpoint detection and response, will go a big way to reigning in the next exploit kit threat you experience. One tactic that won't show as much return on investment is security education awareness - and that's because, as mentioned above, most exploit kit attacks happen in the background and without the user's knowledge.


Latest Trustwave Blogs

The Two Sides of ChatGPT: Helping MDR Detect Blind Spots While Bolstering the Phishing Threat

ChatGPT is proving to be something of a double-edged sword when it comes to cybersecurity.

Read More

Trustwave MailMarshal Email Security Protects Against WinRAR Vulnerability CVE-2023-38831

The importance of email security cannot be understated. Proof of this can be seen in some recent research conducted by the Trustwave SpiderLabs team around our email security product MailMarshal.

Read More

Bah, Humbug! Grinchbots and Freebie Bots Attempt to Ruin Holiday Shopping for Consumers and Retailers

If the holiday classic “How the Grinch Stole Christmas” was remade in 2023, the mean green guy might be played by an Internet bot.

Read More