Loading story…
Multiple exploit kits remained active despite the broader decline of the exploit-kit ecosystem, using malvertising, compromised sites, and traffic distribution systems to drive victims to landing pages that exploited legacy Internet Explorer and Adobe Flash Player vulnerabilities. Reports identified RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude, Angler, and GreenFlash Sundown abusing flaws including CVE-2021-26411, CVE-2020-1380, CVE-2018-8174, CVE-2018-15982, CVE-2018-4878, CVE-2016-0189, and CVE-2015-0311. Researchers said continued Internet Explorer use, unsupported Flash installations, and region-specific targeting kept drive-by download attacks viable, particularly across Japan, South Korea, Taiwan, Hong Kong, Malaysia, and other parts of Asia.
The campaigns delivered a wide range of malware families, showing that exploit kits were still an effective access vector for both cybercrime and broader malware operations. Spelevo was tied to the Japanese PseudoGate campaign distributing Ursnif, SmokeLoader, Ramnit, Kronos, and Zloader; RIG was seen pushing Pitou.B and ransomware such as CryptoLuck and Revenge; Magnitude delivered Magniber ransomware; Underminer deployed a bootkit and coinminer; GreenFlash Sundown delivered Hermes ransomware; Angler installed the Bedep trojan; and PurpleFox was linked to DirtyMoe cryptojacking and DDoS malware. The reporting underscored that unpatched or unsupported browsers and plugins continued to expose organizations to silent compromise, ransomware, banking trojans, spam bots, and cryptomining infections.
Pull IOCs and campaign context straight into your stack.
32 events from the most recent confirmed update back to the earliest known activity.
Magnitude exploit kit activity was reported in April 2021, including use of CVE-2021-26411.
Underminer exploit kit reappeared in April 2021 after being silent since November 2020.
Bottle exploit kit returned in April 2021 and was observed exploiting both CVE-2020-1380 and CVE-2021-26411 while targeting Japan.
PurpleFox exploit kit started exploiting CVE-2021-26411 in April 2021 to deliver PurpleFox malware.
RIG exploit kit started exploiting Internet Explorer vulnerability CVE-2021-26411 in April 2021.
Drive-by download attacks using exploit kits were still being observed in April 2021, with six kits active: RIG, Spelevo, PurpleFox, Underminer, Bottle, and Magnitude.
Researchers analyzed PseudoGate traffic observed in late February 2021, documenting a Keitaro TDS redirection chain leading to Spelevo exploitation of CVE-2018-15982 and delivery of banking trojans.
PseudoGate began using the Spelevo exploit kit instead of Fallout around December 2020.
A malware infection observed on June 24, 2019 showed makemoneyeasywith[.]me redirecting victims to a RIG exploit kit landing page, which served a Flash exploit and then delivered the Pitou.B Trojan.
Indicators showing makemoneyeasywith[.]me redirecting to RIG exploit kit were reported as early as June 21, 2019.
The domain makemoneyeasywith[.]me, used as a gate in a RIG exploit kit malvertising campaign, was registered.
Spelevo exploit kit appeared in 2019 and later remained one of the most active exploit kits observed in 2021.
In April 2018, Magnitude briefly distributed GandCrab ransomware after adopting the Flash zero-day CVE-2018-4878.
Telemetry recorded the first observed hit in a South Korea-focused campaign using GreenFlash Sundown exploit kit and CVE-2018-4878 to deliver Hermes ransomware 2.1.
PseudoGate was reported in 2018 as a Japanese-language drive-by download campaign delivering banking trojans.
In October 2017, the Magnitude operator switched to distributing Magniber ransomware, initially with campaigns heavily restricted to South Korea.
Researchers linked signs of Underminer exploit kit activity back to late 2017, before its public naming in 2018.
DirtyMoe's first significant observed activity occurred in 2017, according to Avast's historical overview of the malware family.
Magnitude exploit kit previously delivered Cerber ransomware through its Magnigate filtering gate in 2017.
The RIG exploit kit had been active since around 2014, according to later reporting on exploit kit activity.
The Magnitude exploit kit was active by 2013, making it one of the longest-running browser exploitation toolkits still in use.
Avast published an overview of DirtyMoe describing PurpleFox as the commonly used exploit kit for distributing the malware and estimating roughly 100,000 active infections.
By mid-2018, Magniber campaigns delivered by Magnitude had expanded beyond South Korea, with exploit attempts observed in Malaysia and infections reported in Taiwan and Hong Kong.
Researchers publicly reported a new exploit kit named Underminer that was distributing a bootkit followed by Hidden Mellifera or Hidden Bee coin-mining malware, with traffic concentrated in Japan, Taiwan, and South Korea.
Trend Micro said it found the first clues of the Underminer exploit kit's existence around July 17.
MDNC discovered that GreenFlash Sundown exploit kit was using Flash zero-day CVE-2018-4878 to distribute Hermes ransomware.
At the end of January, KrCERT published news about targeted attacks using Flash Player zero-day CVE-2018-4878.
Broad Analysis and Brad Duncan observed the Revenge ransomware variant, a CryptoMix/CryptFile2 offshoot, being distributed through hacked websites using the RIG exploit kit.
Proofpoint researcher Kafeine discovered the CryptoLuck ransomware family being distributed through the RIG-E exploit kit, including malvertising in the adult website space.
Adobe remediated CVE-2015-0311 by releasing Flash Player version 16.0.0.296.
Adobe released security advisory APSA15-01 in response to the in-the-wild exploitation of Flash zero-day CVE-2015-0311.
A malvertising campaign redirected users from legitimate sites to Angler Exploit Kit landing pages that actively exploited Adobe Flash zero-day CVE-2015-0311 and installed the Bedep Trojan.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 57 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
10 references tracked. Mallory keeps watching after this page renders.
decoded.avast.io
Open sourcenao-sec.org
Open sourceinsight-jp.nttsecurity.com
Open sourceisc.sans.edu
Open sourcemalwarebytes.com
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourcezscaler.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Magnitude exploit kit** remained active and under active development, continuing to deliver ransomware through **malvertising** to users in Asia-Pacific countries despite the broader decline of exploit kits. Over a 12-month period, researchers observed frequent changes to its shellcode, payload delivery, process injection techniques, and anti-analysis logic, indicating sustained operator investment and adaptation. In early 2020, the kit moved from exploiting `CVE-2018-8174` to `CVE-2019-1367`, a Microsoft Internet Explorer flaw in the legacy JScript engine, and also used a previously unknown elevation-of-privilege exploit for `CVE-2018-8641` in `win32k`. The delivered ransomware used **Microsoft CryptoAPI** to encrypt files, dropped ransom notes, and attempted to delete shadow copies through a UAC bypass, reinforcing that unpatched Internet Explorer systems remained exposed to a mature exploit-to-ransomware infection chain.
Aug 14, 2026
The **Magniber** ransomware operation used multiple Windows and Internet Explorer vulnerabilities to compromise victims, with researchers linking the group to attacks that first abused **PrintNightmare** `CVE-2021-34527` and later shifted to browser-based exploitation through `CVE-2021-26411` and `CVE-2021-40444`. CrowdStrike reported Magniber weaponized the remote code execution variant in the Windows Print Spooler service, while subsequent reporting showed the group moving to malvertising-driven infections that delivered ransomware through Internet Explorer flaws. The activity was heavily concentrated in **South Korea** and broader parts of Asia, matching Magniber’s long-standing regional targeting. Avast said the group’s **Magnitude exploit kit** remained active and mature, using adult-site malvertising, victim-specific subdomains, rapidly rotating infrastructure, and polymorphic obfuscation to reach vulnerable Internet Explorer users. The exploit chain also incorporated `CVE-2020-0986` for local privilege escalation and sandbox escape before deploying Magniber, which encrypts files, attempts to delete shadow copies, and typically avoids data-theft or double-extortion tactics. Researchers noted the ransomware had been rewritten multiple times, remained effectively uncracked, and in some cases contained flaws that could leave encrypted files unrecoverable even for the attackers.
Aug 15, 2026
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026