CVE-2024-3400: PAN-OS Command Injection Vulnerability in GlobalProtect Gateway. Learn More

CVE-2024-3400: PAN-OS Command Injection Vulnerability in GlobalProtect Gateway. Learn More

Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

Database Security

Prevent unauthorized access and exceed compliance requirements.

Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

Why Exploit Kits Are Going Dark

Three years ago, I devoted a blog post to the alarming uptick in exploit kit attacks, specifically due to Magnitude, which had recently gone on an unprecedented rampage in which it attempted to exploit 1.1 million machines over the course of a month, succeeding with about a hundred thousand. I even declared that "most of the attacks that occur on the web these days originate from these malicious toolkits."

How times have changed. Nowadays a glimpse into the exploit kit market may turn up more tumbleweeds than fraud. That's not to say the activity has completely dried up, but there is a noticeable shakeup and disappearance of major players. As the 2017 Trustwave Global Security Report noted: "The most common exploit kits in the world - Angler, Magnitude and Nuclear - disappeared or went private in 2016."

What the heck happened?

Experts point to a few reasons accounting for the fade of these crimeware packages, which come with pre-written code that automates the exploitation of client-side vulnerabilities, such as browser plug-ins, making it simple for even novice crooks to quietly deliver exploits and malware to unsuspecting users, usually via drive-by download attacks enabled through malicious advertisements.

1) Takedowns and Arrests

Cybercrime can be disrupted when forces unite - from researchers to law enforcement - to impede illegal operations. For example, many have attributed the disappearance of Nuclear, a longtime fixture on the exploit kit circuit, to a major technical analysis written about it in April 2016. That same month, "Paunch," the nicknamed author of the Blackhole exploit kit, was sentenced to seven years in prison. And a couple of months later, the popular Angler kit disappeared into the abyss, possibly related to the arrest of the so-called Lurk Trojan gang. Even RIG, arguably the largest beneficiary of the exploit market shakeup of 2016, has seen better days.

2) Software Makers Stepping Up

The No. 1 key to staying protected against exploit kits is keeping your patches up to date. There is no secret how important patching is, yet businesses still struggle with it due to the many roadblocks that stand in its way. Browser and software manufacturers like Adobe and Oracle have offered assistance by delivering more resilient products - and in some cases killing the biggest troublemakers, like Java and Flash. Other factors include improved browser security and the relative abandonment of Internet Explorer (IE), whose market share is plummeting and rendering the large stable of legacy IE bugs unusable.

3) Better Options for Cybercriminals

Cybercriminals are ever the profit-minded bunch. Not only are exploit kits facing resistance from the factors mentioned above, they also are expensive to operate and maintain. If kit developers believe the risk and cost of operating exploit kits is too burdensome, they will simply look elsewhere. And most are looking to spam and phishing to distribute malware and ransomware. The 2017 Trustwave Global Security Report found that 60 percent of all inbound email was spam in 2016, up from 54 percent in 2015, and the percentage of spam messages containing malware was 35 percent, up 3 percent. No surprise, then, that studies have found that nine out of every 10 breaches has a phishing or social engineering connection.


So, is it safe to assume we will never return to the earlier levels of exploit kit activity? That is virtually impossible to predict. But one thing we know for sure is that the era of exploit kits is not over. In fact, our SpiderLabs team recently reported on the "Terror" kit (despite it apparently being littered with programming errors), and RIG is responsible for a recent spate of compromised websites. The market is undoubtedly in flux, but criminals appear not ready to completely discard a revenue source, especially one as convenient as exploit kits, which typically are sold or rented to customers for sizable sums.

The good news is that the technical advice for protecting against exploit kits is like if the malware or ransomware attempted to infect your machines in some other way. Solutions, from the traditional like intrusion prevention systems and unified threat management, to the more advanced, like web security gateways and endpoint detection and response, will go a big way to reigning in the next exploit kit threat you experience. One tactic that won't show as much return on investment is security education awareness - and that's because, as mentioned above, most exploit kit attacks happen in the background and without the user's knowledge.


Latest Trustwave Blogs

Law Enforcement Must Keep up the Pressure on Cybergangs

The (apparent) takedown of major ransomware players like Blackcat/ALPHV and LockBit and the threat groups’ (apparent) revival is a prime example of the Whack-a-Mole nature of combating ransomware...

Read More

Effective Cybersecurity Incident Response: What to Expect from Your MDR Provider

Companies engage with a managed detection and response (MDR) provider to help ensure they detect cyber threats before they do any damage. The "response" part of the MDR moniker is key to that effort,...

Read More

The Power of Red and Purple Team Drills in Enhancing Offensive Security Programs

Despite investing in costly security solutions, keeping up with patches, and educating employees about suspicious emails, breaches still occur, leaving many organizations to wonder why they are...

Read More