8/11/2018 Threat Landscape Dashboard | McAfee

pp g
Business Region
Partners 

Business Home (/enterprise/en-us/home.html) 

Threat
Landscape
Dashboard
Exploit Kits ×

Assessing today's threats and

the relationships between

Feedback
How likely are you to recommend McAfee to
them your business colleagues?

0 1 2 3 4 5 6 7 8 9 10
Home (/enterprise/en-us/threat-center/threat-landscape-dashboard.html) Exploit K
not at all very likely

Campaigns (/enterprise/en-us/threat-center/threat-landscape-dashboard/campaigns.html)
Continue

Ransomware (/enterprise/en-us/threat-center/threat-landscape-dashboard/ransomware.htm

Vulnerabilities (/enterprise/en-us/threat-center/threat-landscape-dashboard/vulnerabilities.h

Top 10 Exploit Kits

Exploit Kits Description

Products & Services Support & Training Threat Awareness

https://www.mcafee.com/enterprise/en-us/threat-center/threat-landscape-dashboard/exploit-kits.html 1/4
8/11/2018 Threat Landscape Dashboard | McAfee
pp g
Business Region
SofosFO/Stamp Exploit Kit Partners
The exploit kit, also known as GrandSoft, uses compromised 
(/enterprise/en-us/threat- websites to infect users with browser vulnerabilities containing
center/threat-landscape- Flash or Java components. The exploit kit is used to infect
dashboard/exploit-kits- victims with ransomware, miners, and various Trojans.
details.sofosfo-stamp-exploit-
kit.html)

Neutrino Exploit Kit Neutrino and its predecessor Neutrino-v are popular exploit kits
(/enterprise/en-us/threat- that surged in mid-2016. They are known for using
center/threat-landscape- compromised sites and malvertising to infect users with various
dashboard/exploit-kits- malware.
details.neutrino-exploit-
kit.html)

Empire Pack Exploit Kit The exploit kit, also referred to RIG-E, surfaced in September
(/enterprise/en-us/threat- 2016 and takes advantage of flaws in Microsoft and Adobe
center/threat-landscape- software.
dashboard/exploit-kits-
details.empire-pack-exploit-
kit.html)

Feedback
Magnitude Exploit Kit Also known as Popads, Magnitude is used in malvertising
(/enterprise/en-us/threat- attacks to infect victims who visit compromised websites.
center/threat-landscape-
dashboard/exploit-kits-
details.magnitude-exploit-
kit.html)

RIG Exploit Kit (/enterprise/en- RIG is spread via suspicious advertisements that have been
us/threat-center/threat- inserted into legitimate websites. The VIP version of the exploit
landscape-dashboard/exploit- kit, RIG-v, appeared in 2016 and uses new URL patterns.
kits-details.rig-exploit-kit.html)

Terror Exploit Kit The exploit kit was discovered in late 2016 and its codebase is
(/enterprise/en-us/threat- from the Sundown exploit kit. The main focus of the exploit kit is
center/threat-landscape- to turn infected systems into miners for the Monero
dashboard/exploit-kits- cryptocurrency.
details.terror-exploit-kit.html)

Products & Services Support & Training Threat Awareness

https://www.mcafee.com/enterprise/en-us/threat-center/threat-landscape-dashboard/exploit-kits.html 2/4
8/11/2018 Threat Landscape Dashboard | McAfee
pp g
Business Region
Nebula Exploit Kit Partners
Nebula, a re-brand of the Sundown exploit kit, is available for 
(/enterprise/en-us/threat- rent by the day, week, or month on underground forums and
center/threat-landscape- offers support to both Russian and English speaking customers.
dashboard/exploit-kits-
details.nebula-exploit-kit.html)

Bizarro Sundown Exploit Kit
(/enterprise/en-us/threat-
center/threat-landscape-
dashboard/exploit-kits-
details.bizarro-sundown-
exploit-kit.html)
The exploit kit, also known as GreenFlash, was first spotted in
October of 2016 and is a predecessor to the Sundown exploit
kit. The private EK is only used by the ShadowGate group (aka
WordsJS).

KaiXin Exploit Kit
(/enterprise/en-us/threat-
center/threat-landscape-
dashboard/exploit-kits-
details.kaixin-exploit-kit.html)
The exploit kit is reported to have originated from China and
focuses on users who visit compromised Korean websites.
KaiXin resurfaced in 2018 and is infecting users with the Gh0st
Remote Access Trojan.

ThreadKit Exploit Kit
(/enterprise/en-us/threat-
center/threat-landscape-
dashboard/exploit-kits-
details.threadkit-exploit-
kit.html)
Feedback
The exploit kit is used to create malicious Microsoft Office
documents in an attempt to exploit a range of Microsoft
vulnerabilities. The builder is sold on the Dark Web and has
been used to infect victims with various malware including
FormBook, Loki Bot, Trickbot, and Chthonic.

About Us
(/en-us/index.html)
About McAfee
Corporate Headquarters
Newsroom
2821 Mission College Blvd.
Santa Clara, CA 95054 USA Careers

Our Customers
1-888-847-8766
(tel:8888478766) Community

Events
Products & Services Support & Training Threat Awareness
     
https://www.mcafee.com/enterprise/en-us/threat-center/threat-landscape-dashboard/exploit-kits.html 3/4
8/11/2018 Threat Landscape Dashboard | McAfee
pp g
     
Business Region
Partners Webinars 
Website Feedback

 United States / English

Contact Us

Work With Us

Partner Portal Login

Resellers

Managed Service Providers

Security Innovation Alliance

Global Strategic Alliances

OEM & Embedded Alliances

Find a Reseller or Distributor

Customer Resources

Feedback
Enterprise Customer & Technical Support

Shop Online

Renew Products

Product Downloads

Free Trials

Free Tools

Services

(//www.scanalert.com/RatingVerif
ref=www.mcafee.com)

Privacy (/enterprise/en-us/about/legal/privacy.html)
Legal Notices (/enterprise/en-us/about/legal/notices.html)
Legal Contracts & Terms (/enterprise/en-
us/about/legal/contracts-terms.html)
Site Map (/enterprise/en-us/site-map.html)

Copyright ©2018 McAfee, LLC

https://www.mcafee.com/enterprise/en-us/threat-center/threat-landscape-dashboard/exploit-kits.html 4/4