Visualizing RedKit Exploits | Recorded Future

Visualizing RedKit Exploits

January 9, 2014 • Chris

The private but popular RedKit exploit kit appears to be experiencing a resurgence based on a report by Kahu Security. Initially spotted back in May 2012, the exploit kit drew attention after cybercriminals used it in drive-by-download attacks from NBC’s compromised website in January 2013 and spam campaigns immediately after the Boston Marathon bombings.

These attacks featured iframes on the compromised websites performing simultaneous actions when rendered in a victim’s web browser. The exploit kit competes against and leverages some of the same exploits as CritXPack, Gong Da, Nuclear Pack, Cool, and Blackhole 2.0. Monitoring developments and adoption of RedKit may be of particular interest given the recent arrest in Russia of Blackhole’s creator.

Here’s a Recorded Future timeline of reports about RedKit since 2012 including notable campaigns and discovery of new vulnerabilities added to the kit:

RedKit Exploit Kit Timeline

View the interactive timeline

Cybercriminals have compromised several high profile sites including but not limited to NBC assets and the Segway website to carry out their operations with RedKit. Security experts have also reported pharmaceutical sites and Japanese commercial channels as hosts for RedKit EK servers.

Here’s a more detailed look at addition of RedKit of exploits for specific vulnerabilities, some of which was already very nicely detailed by Malwaggedon, as well as the malware being dropped on successful exploitation and other exploit kits with which it has been partnered:

RedKit Exploit Timeline

View the interactive timeline

RedKit EK initially included two exploits – targeting CVE-2010-0188 (Adobe Acrobat and Reader LibTIFF) and CVE-2012-0507 (Java AtomicReferenceArray) – before expanding to include at least nine different exploits. The most recent additions – targeting CVE-2013-0431 and CVE-2013-1493 – were observed in the compromise of Segway’s website.

What’s an example of RedKit in action? On April 16, the Kelihos and Cutwail botnets began sending out spam with subject lines related to the Boston bombing. The emails referred recipients to a site that would compromise their systems via the RedKit exploit kit and install bot software as well as the ZeroAccess trojan used to mine Bitcoin.

RedKit Exploit Network

View the interactive timeline

Monitor Exploit Developments

Out of the above information discovery conducted using Recorded Future, we put together a list of the nine vulnerabilities, most of them related to Java, exploited by RedKit and set up a monitoring dashboard that displays recently discussed technical details.

Reach out to us at Recorded Future if you’d be interested in real-time alerts on these or related issues, and please also drop by the Naked Security blog by Sophos that has provided two in-depth blog posts on RedKit.

New call-to-action

Related Posts

How The Stadtwerke Klagenfurt Group Reduces Risk to Critical Infrastructure

How The Stadtwerke Klagenfurt Group Reduces Risk to Critical Infrastructure

November 17, 2020 • The Recorded Future Team

Key Takeaways The Stadtwerke Klagenfurt Group delivers essential municipal services,...

Security Intelligence Handbook Chapter 2: Examining Operational and Strategic Security Intelligence

Security Intelligence Handbook Chapter 2: Examining Operational and Strategic Security Intelligence

November 12, 2020 • The Recorded Future Team

Editor’s Note: Over the next several weeks, we’re sharing excerpts from the third edition of...

How Predict 2020 Disrupted the Status Quo

How Predict 2020 Disrupted the Status Quo

October 9, 2020 • The Recorded Future Team

While Predict 2020 looked a bit different this year, the world’s largest security intelligence...