In total, the new variant of the notorious crimeware has infected more than 1.25 million computers
Security researchers at Trustwave analyzed the latest variant of the RIG Exploit Kit, concluding that the new version 3.0 of the crimeware has infected more than 1.25 million devices worldwide.
And while the Rig Exploit Kit's reputation suffered a serious blow when one of its resellers leaked part of the source code online, its developer has come back strongly, with a new improved version.
Trustwave researchers claim that this advanced variant of the program mainly exploits Flash vulnerabilities, and primarily two zero-day exploits that were revealed last month (CVE-2015-5119 and CVE-2015-5122) as part of new attacks by the Hacking Team.
Through the exploitation of these vulnerabilities, target computers are infected with malware, while in 70% of cases the spambot, “Tofsee”, is distributed.
RIG spreads malware through malvertising campaigns
According to Trustwave researchers, 90% of the traffic in the various RIG Exploit Kit campaigns was the result of malicious advertising (malvertisement).
Using this method dramatically increases the number of potential victims, as even users who systematically avoid untrustworthy websites are targeted.
Since malicious campaigns can be spread through popular websites, such as Yahoo, CBS, etc., victims do not need to change their web browsing habits to become infected.
Researchers point out that version 3.0 of the Rig Exploit Kit has attempted to infect 3.5 million computer systems, while in total it has so far managed to infect 1.25 million devices.
What is particularly impressive is the fact that although the source code of Rig Exploit Kit 2.0 has been leaked, version 3.0 uses a similar infrastructure, without significant changes to the three-layer system used, which consists of proxy servers, VDS Tunnels, and a backend panel for managing malicious campaigns.
