This post was authored by Nick Biasini with contributions from Joel Esler, Nick Hebert, Warren Mercer, Matt Olney, Melissa Taylor, and Craig Williams.

Executive Summary

Today, Cisco struck a blow to a group of hackers, disrupting a significant international revenue stream generated by the notorious Angler Exploit Kit.  Angler is one of the largest exploit kit found on the market and has been making news as it has been linked to several high-profile malvertising/ransomware campaigns. This is the most advanced and concerning exploit kit on the market -designed to bypass security devices and ultimately attack the largest number of devices possible.

In its research, Cisco determined that an inordinate number of proxy servers used by Angler were located on servers of service provider Limestone Networks - - with the primary threat actor responsible for up to 50 percent of Angler Exploit Kit activity, targeting up to 90,000 victims a day, and generating more than$30M annually.  This implies that if you apply the full scope of Angler activity the revenue generated could exceed$60M annually. Talos gained additional visibility into the global activity of the network through their ongoing collaboration with Level 3 Threat Research Labs. Finally, thanks to our continued collaboration with OpenDNS we were able to gain in-depth visibility into the domain activity associated with the adversaries.

Cisco then took action:

• Shutting down access for customers by updating products to stop redirects to the Angler proxy servers.
• Released Snort rules to detect and block checks from the health checks
• All rules are being released to the community through  Snort
• Publishing communications mechanisms including protocols so others can protect themselves and customers.
• Cisco is also publishing IoCs so that defenders can analyze their own network activity and block access to remaining servers

This is a significant blow to the emerging hacker economy where ransomware and the black market sale of stolen IP, credit card info and personally identifiable information (PII) are generating hundreds of millions of dollars annually.

Watch Angler compromise a box and install ransomware at the end of the video.

Technical Overview

It seems like every week Angler Exploit Kit is in the news, whether it's Domain Shadowing, 0day integration, or large scale malvertising campaigns, it consistently dominates the threat landscape. It's a constant fight between the adversaries and the defenders. We are constantly monitoring and updating coverage for the threat. Based on this constant battle, Talos decided to dive deep on Angler's telemetry data and has made some astounding discoveries.

The dataset was originally from July 2015 and included data from all sources available. July provided a unique opportunity because Angler went through several iterations of development, including URL structure changes and implementation of several unpatched Adobe Flash vulnerabilities. During the analysis, trends and patterns emerged. This paper will discuss trends in hosting, domain usage, referers, exploits, and payloads. It was the trends associated with the hosting that lead to the most significant discoveries.

While analyzing the data we found that a large amount of Angler activity was focused with a single hosting provider, Limestone Networks. Talos collaborated with Limestone to gather some previously unknown insight into Angler. This includes details related to data flow, management, and scale.

Angler is actually constructed in a proxy/server configuration. There is a single exploit server that is responsible for serving the malicious activity through multiple proxy servers. The proxy server is the system that users communicate with, allowing the adversary to quickly pivot and change while still shielding the exploit server from identification and exposure. Additionally, there is a health monitoring server that is conducting health checks, gathering information about the hosts that are being served exploits, and remotely erase the log files once they have been fetched. This health server revealed the scope and scale of the campaign, and helped allow us to put a monetary value on the activity.

A single health server was seen monitoring 147 proxy servers over the span of a month and generating in excess of$3,000,000 USD in revenue. This single adversary was responsible for approximately half of the Angler activity we observed and is making more than$30,000,000 USD annually from Ransomware infections alone.

The monetization of the malware economy has continued to evolve over the last several years. Every single year we see small innovations that lead towards the occasional major advance. Today we're seeing the results of years of major advances being combined with a drive by download vector to form one of the most effective and profitable attacks facing the internet.

Due to the dynamic nature of some of the content the full article can be found at talosintel.com here.