Even before the Angler Exploit Kit (EK) shuts down its operation towards the end of May – early June, the Nuclear Exploit Kit has disappeared, according to multiple sources in the security industry.
Nuclear EK was one of the largest sources of ransomware infections, known for delivering the Locky ransomware, among many other threats.
The Exploit Kit has always been popular, being one of the top five Exploit Kits in use, but around April 30th, multiple sources say they stopped seeing any kind of activity from the Nuclear infrastructure, as if someone had pulled the plug and never turned it back on.
Check Point says this happened after the company published a two-part analysis of the exploit kit's in-depth activity. The first of these parts was published about a week before security firms noticed Nuclear's disappearance.
While the first part “broke” the technical side of the Nuclear business, the second part that came around mid-May also gave a glimpse into the financial side of the Kit, revealing that the EK editors may be based in Krasnodar, Russia, and are likely making around $100,000 a month.
The Check Point report appears to have scared the scammers running this malicious malware-as-a-service infrastructure, who chose to hide in the shadows and enjoy their money.
In addition to Check Point, French security researcher Kafeine noted the death of Nuclear when he first published news about the Angler.
A few weeks later, Symantec also noted the disappearance of Nuclear, saying: "The Nuclear Exploit Kit, which was first on the list in April, has fallen out of the top five this month, likely due to research released in late April shedding light on the toolkit and potentially leading to disruptions."
After the closure of Nuclear and Angler, the Exploit Kit market is dominated by Neutrino EK, followed by Magnitude, RIG, and Sundown.
