RIG Exploit Kit

RIG Exploit Kit is a financially motivated exploit kit active since 2014 that has been widely used in drive-by compromise chains to deliver a variety of malware payloads. It is commonly deployed through compromised or malicious websites and malvertising-driven redirection chains, where victims are funneled to exploit landing pages that profile the browser environment and attempt client-side exploitation. Reported payloads delivered through RIG have included banking trojans, downloader trojans, ransomware, cryptocurrency miners, information stealers, and other follow-on malware families such as Purple Fox and Gootkit-associated infection chains.

RIG is associated with web-based initial access rather than being a payload itself. Campaigns using RIG have leveraged browser and plugin vulnerabilities, particularly in Adobe Flash Player and Internet Explorer-era scripting engines, to execute code on victim systems and retrieve secondary malware. Observed operations have also used fingerprinting and anti-bot techniques to evade researchers and automated analysis systems before serving exploits. In some campaigns, RIG formed part of broader traffic distribution and malvertising ecosystems that redirected users from ordinary websites or malicious advertisements to exploit infrastructure.

The kit has been used by financially motivated cybercrime operations and has appeared in campaigns targeting general internet users as well as business environments, depending on the payload delivered. Its long operational history and repeated use as a malware delivery platform make it a notable exploit kit in post-Angler web exploitation activity.