Why Exploit Kits Are Going Dark

Three years ago, I devoted a blog post to the alarming uptick in exploit kit attacks, specifically due to Magnitude, which had recently gone on an unprecedented rampage in which it attempted to exploit 1.1 million machines over the course of a month, succeeding with about a hundred thousand. I even declared that "most of the attacks that occur on the web these days originate from these malicious toolkits."

How times have changed. Nowadays a glimpse into the exploit kit market may turn up more tumbleweeds than fraud. That's not to say the activity has completely dried up, but there is a noticeable shakeup and disappearance of major players. As the 2017 Trustwave Global Security Report noted: "The most common exploit kits in the world - Angler, Magnitude and Nuclear - disappeared or went private in 2016."

What the heck happened?

Experts point to a few reasons accounting for the fade of these crimeware packages, which come with pre-written code that automates the exploitation of client-side vulnerabilities, such as browser plug-ins, making it simple for even novice crooks to quietly deliver exploits and malware to unsuspecting users, usually via drive-by download attacks enabled through malicious advertisements.

1) Takedowns and Arrests

Cybercrime can be disrupted when forces unite - from researchers to law enforcement - to impede illegal operations. For example, many have attributed the disappearance of Nuclear, a longtime fixture on the exploit kit circuit, to a major technical analysis written about it in April 2016. That same month, "Paunch," the nicknamed author of the Blackhole exploit kit, was sentenced to seven years in prison. And a couple of months later, the popular Angler kit disappeared into the abyss, possibly related to the arrest of the so-called Lurk Trojan gang. Even RIG, arguably the largest beneficiary of the exploit market shakeup of 2016, has seen better days.

2) Software Makers Stepping Up

The No. 1 key to staying protected against exploit kits is keeping your patches up to date. There is no secret how important patching is, yet businesses still struggle with it due to the many roadblocks that stand in its way. Browser and software manufacturers like Adobe and Oracle have offered assistance by delivering more resilient products - and in some cases killing the biggest troublemakers, like Java and Flash. Other factors include improved browser security and the relative abandonment of Internet Explorer (IE), whose market share is plummeting and rendering the large stable of legacy IE bugs unusable.

3) Better Options for Cybercriminals

Cybercriminals are ever the profit-minded bunch. Not only are exploit kits facing resistance from the factors mentioned above, they also are expensive to operate and maintain. If kit developers believe the risk and cost of operating exploit kits is too burdensome, they will simply look elsewhere. And most are looking to spam and phishing to distribute malware and ransomware. The 2017 Trustwave Global Security Report found that 60 percent of all inbound email was spam in 2016, up from 54 percent in 2015, and the percentage of spam messages containing malware was 35 percent, up 3 percent. No surprise, then, that studies have found that nine out of every 10 breaches has a phishing or social engineering connection.

***

So, is it safe to assume we will never return to the earlier levels of exploit kit activity? That is virtually impossible to predict. But one thing we know for sure is that the era of exploit kits is not over. In fact, our SpiderLabs team recently reported on the "Terror" kit (despite it apparently being littered with programming errors), and RIG is responsible for a recent spate of compromised websites. The market is undoubtedly in flux, but criminals appear not ready to completely discard a revenue source, especially one as convenient as exploit kits, which typically are sold or rented to customers for sizable sums.

The good news is that the technical advice for protecting against exploit kits is like if the malware or ransomware attempted to infect your machines in some other way. Solutions, from the traditional like intrusion prevention systems and unified threat management, to the more advanced, like web security gateways and endpoint detection and response, will go a big way to reigning in the next exploit kit threat you experience. One tactic that won't show as much return on investment is security education awareness - and that's because, as mentioned above, most exploit kit attacks happen in the background and without the user's knowledge.