Tag Archives: drive-by

The Resurrection of RedKit

Posted on January 7, 2014 by darryl

“RedKit” was once a thriving exploit pack then faded away leaving behind artifacts on several abandoned hosts which are still triggering broken redirection alerts to this day. Within the past couple of months, however, we are witnessing a deliberate return … Continue reading →

Posted in Exploit Packs | Tagged , , , , | Comments Off on The Resurrection of RedKit

Playing Hide and Seek with Malicious Scripts

Posted on July 7, 2012 by darryl

When I encounter a drive-by download that involves a compromised host, there will usually be a malicious script somewhere on the website. The “malicious script” could be a meta refresh tag, an iframe, an external Javascript file, or even in … Continue reading →

Posted in Malscript | Tagged , , , | 3 Comments

Techno XPack

Posted on January 28, 2012 by darryl

There’s another new exploit pack in town called Techno XPack. This one looks like a re-skinned BleedingLife. Here’s a list of the exploits it’s packing: CVE-2008-2992 CVE-2010-0188 CVE-2010-0842 CVE-2010-1297 CVE-2010-2884 CVE-2010-3552 CVE-2010-3654 JavaSignedApplet Panel shots:

Posted in Exploit Packs | Tagged , , | Leave a comment

Hierarchy Exploit Pack

Posted on January 27, 2012 by darryl

A new pack has emerged called Hierarchy Exploit Pack. Looks a lot like Eleonore but its exploits are different: CVE-2006-0003 CVE-2009-0927 CVE-2010-0094 CVE-2010-0188 CVE-2010-0806 CVE-2010-0840 CVE-2010-1297 CVE-2010-1885 CVE-2011-0611 JavaSignedApplet Here are some panel shots:

Posted in Exploit Packs | Tagged , , | 4 Comments

Chinese Exploit Packs

Posted on January 12, 2012 by darryl

While it can be difficult to attribute exploit packs in many cases, I believe it’s safe to say that there are a few made by Chinese authors. Their style can be seen across packs from the script used for traffic … Continue reading →

Posted in Exploit Packs | Tagged , , , , , , , , , | 4 Comments