Threat video1:00
Radio Exploit Kit Delivers AZORult: Detection & IOCs
Radio EK's drive-by exploits CVE-2016-0189 to drop unencrypted AZORult. 9 detection rules (one free in Splunk SPL) and 16 IOCs.
Read the full threat intel for Radio Exploit Kit Delivers AZORult: Detection & IOCs →
Chapters
- 0:00The hookExploit Kit: about five updates, four days.
- 0:04The storyMalvertising redirected victims through Radio Exploit Kit.
- 0:12Attack pathResearchers analyzed malvertising redirecting to old Radio Exploit Kit.
- 0:29AttributionNo threat actor: this was defensive research.
- 0:33Indicators of compromise14 indicators to hunt: 2 IPs, 2 domains and 8 URLs, and more.
- 0:39MITRE ATT&CK techniques4 ATT&CK techniques, from resource development to execution.
- 0:44Remediation3 steps now: Block radiobox-online[.]org, 2no[.]co.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Exploit Kit: about five updates, four days.
0:05Malvertising redirected victims through Radio Exploit Kit.
0:09It delivered the AZORult stealer.
0:12Researchers analyzed malvertising redirecting to old Radio Exploit Kit.
0:17Exploit ran in Internet Explorer, launched PowerShell.
0:21PowerShell fetched malware, AZORult executed.
0:24The stealer collected credentials and wallet data.
0:29No threat actor: this was defensive research.
0:3314 indicators to hunt: 2 IPs, 2 domains and 8 URLs, and more.
0:404 ATT&CK techniques, from resource development to execution.
0:443 steps now: Block radiobox-online[.]org, 2no[.]co.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.