Full Blog Post >> http://cs.co/9004FdMo Over the last several months Talos researchers have been monitoring a massive exploit kit campaign that is utilizing hijacked registrant accounts to create large amounts of subdomains for both initial redirection and exploitation. This campaign has been largely attributed to Angler Exploit Kit with fileless exploits serving various malicious payloads. The use of hijacked accounts lead to a larger research project into the use of hijacked registrant accounts. During this research the earliest examples were found from a 2011 campaign with sporadic usage until December 2014. Since December 2014 more than 75% of the subdomain activity has occurred indicating a major shift in approach. This behavior has been covered before which discussed some of the older campaigns as well as the hosting indicators (ASN) of the groups making use of the subdomains.

1. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 1
© 2014 Cisco and/or its affiliates. All rights reserved.
Angler Lurking in the Domain Shadows

3. Evasion Evolution
Exploit Kit Evolution
• Static IP Address
• Registered Domains
• Fast Flux DNS
• Dynamic DNS
Fast Flux DNS
A
1.2.3.4
34.1
• Domain Shadowing
1.2
bad.domain.corn 4.1.2.3
4.3.2.2
cJecg
doj!Ul(l
s.JbOornalns
hpec:aDaJnu£
IJIUW-.t:lf411,1UIIUI I
TaLOS
Domain Shadowing
Hijacke Legit Domain
II'
1
_ 176.3L156.152
.-::: I[
._,. 17fi 51

4. Protecting the customer
• Cisco AMP & Network Security IDS &
NGFW detected and blocked immediately
• Defense-in-Depth is still best approach to
protect your environment
• Expect this technique to increase in
popularity
• For more information and posts visit
htt ://blo s.cisco.com/talos
'
TaLOS
Product • • •
AMP
cws
ESA N/A
Netwo
Security
WSA