Enterprise users infected by RIG Exploit Kit thanks to Internet Explorer

The RIG Exploit Kit is currently in the midst of its most productive phase, attempting approximately 2,000 incursions everyday and succeeding in about 30% of them, the best success rate in the long operational history of the service.

RIG EK has been observed distributing several malware families, including Dridex, SmokeLoader, and RaccoonStealer, by taking use of relatively outdated Internet Explorer flaws.

The exploit kit continues to pose a serious, widespread threat to people and organisations, according to a thorough study by Prodaft, whose researchers have access to the service’s backend web panel.

RIG EK’s sordid history

RIG EK was first released eight years ago, in 2014, and promoted as an “exploit-as-a-service” rented to other malware operators to spread their malware on vulnerable devices.

The RIG exploit kit is a set of malicious JavaScript scripts embedded in compromised or malicious websites by the threat actors, which are then promoted through malvertising.

When a user visits these sites, the malicious scripts will be executed and attempt to exploit various vulnerabilities in the browser to install malware on the device automatically.

In 2015, the kit’s authors released the second major version of the kit, laying the ground for more extensive and successful operations.

In 2017 though, RIG suffered a significant blow following a coordinated takedown action that wiped out large parts of its infrastructure, severely disrupting its operations.

In 2019, RIG returned, this time focusing on ransomware distribution, helping Sodinokibi (REvil), Nemty, and ERIS ransomware, compromise organizations with data-encrypting payloads.

Current attack volumes

Prodaft says RIG EK currently targets 207 countries, launching an average of 2,000 attacks per day and having a current success rate of 30%. This rate was 22% before the exploit kit resurfaced with two new exploits, says Prodaft.

As the heatmap published in the report shows, the most impacted countries are Germany, Italy, France, Russia, Turkey, Saudi Arabia, Egypt, Algeria, Mexico, and Brazil. However, there are victims worldwide

The highest success rate is brought by CVE-2021-26411, achieving a 45% successful exploitation ratio, followed by CVE-2016-0189 with 29% and CVE-2019-0752 with 10%.

“The RIG administrator had taken additional manual configuration steps to ensure that the malware was distributed smoothly,” explains Prodaft in the report.

“Considering all these facts, we assess with high confidence that the developer of Dridex malware has a close relationship with the RIG’s admins.”

RIG EK breaches may result in data-encryption issues, as Dridex was previously connected to Entropy ransomware outbreaks.

The RIG EK continues to pose a serious threat to people and companies running out-of-date software, threatening to infect their computers with sly data thieves that can steal highly-sensitive information.

Nevertheless, because Microsoft officially terminated Internet Explorer in February 2023 and redirected users to Microsoft Edge, RIG EK’s emphasis on Internet Explorer may cause the service to quickly become out of date.

Suggest an edit to this article

Cybersecurity Knowledge Base

Homepage

Remember, CyberSecurity Starts With You!

• Globally, 30,000 websites are hacked daily.
• 64% of companies worldwide have experienced at least one form of a cyber attack.
• There were 20M breached records in March 2021.
• In 2020, ransomware cases grew by 150%.
• Email is responsible for around 94% of all malware.
• Every 39 seconds, there is a new attack somewhere on the web.
• An average of around 24,000 malicious mobile apps are blocked daily on the internet.