Tool
tool:angler
Also: Angler Exploit Kit
Exploit kit used to identify vulnerable software and deliver payloads, including ransomware.
Exploit kit used to identify vulnerable software and deliver payloads, including ransomware.
“One exploit kit found for sale on the dark web is called Angler.”
“Angler is an exploit kit, meaning it doesn’t just contain one exploit”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | DEVELOPED_BY | Russian crime group | Uncertain | 44 |
| outgoing | EXPLOITS | Use After Free vulnerability | Explicit | 44 |
| outgoing | AFFECTS | Adobe Flash | Explicit | 44 |
| outgoing | USES | Reveton | Explicit | 44 |
| outgoing | RELATED_TO | Lurk | Attributed | 44 |
| incoming | USES | Zain Qaiser | Explicit | 44 |
Angler DEVELOPED_BY Russian crime group
Jack says Angler was probably Russian-made and later refers to the Russian coders who made it.
Uncertain Confidence 94% · Jack Rhysider EP 44 Details
“We think it was probably Russian-made.”
“the Russian coders who made it had a zero-day vulnerability in it, too”
Angler EXPLOITS Use After Free vulnerability
Jack explains that Use After Free is one of the vulnerabilities Angler will use to execute commands on a victim's computer.
Explicit Confidence 99% · Jack Rhysider EP 44 Details
“One of the vulnerabilities the Angler Exploit Kit will use is what’s called a Use After Free vulnerability.”
Angler AFFECTS Adobe Flash
Jack says the Angler creators had a zero-day vulnerability in Adobe Flash.
Explicit Confidence 98% · Jack Rhysider EP 44 Details
“the Russian coders who made it had a zero-day vulnerability in it, too, a vulnerability in Adobe Flash”
Zain weaponized Angler by equipping it with the Reveton ransomware payload.
Explicit Confidence 99% · Jack Rhysider EP 44 Details
“Zain decided to weaponize Angler with Reveton.”
Zain Qaiser USES Angler
Zain obtained and deployed Angler as the exploit kit for his ransomware operation.
Explicit Confidence 98% · Jack Rhysider EP 44 Details
“He got the Angler Exploit Kit which is good at getting into the victim’s computer”
Cisco Talos reportedly found links between Angler and Lurk, but Jack presents the relationship as possible rather than certain.
Attributed Confidence 86% · Jack Rhysider EP 44 Details
“Cisco Talos research group looked into this a little further and found links between Angler and Lurk.”