XXX - AEK - Axpergle - Retired - Last seen: 2016-06-07
The Angler Exploit Kit has been the most popular and evolved exploit kit from 2014 to middle of 2016. There was several variation. The historical "indexm" variant was used to spread Lurk. A vip version used notabily to spread Poweliks, the "standard" commercial version, and a declinaison tied to load selling (mostly bankers) that can be associated to EmpirePPC
Stegano EK - Active
Astrum Exploit Kit is a private Exploit Kit used in massive scale malvertising campaigns. It's notable by its use of Steganography
RouterEK - Active
DNSChanger Exploit Kit is an exploit kit targeting Routers via the browser.
Sednit RTF EK - Active
DealersChoice is a Flash Player Exploit platform triggered by RTF.
Disdain EK has been introduced on underground forum on 2017-08-07. The panel is stolen from Sundown, the pattern are Terror alike and the obfuscation reminds Nebula.
RIG-E - Retired - Last seen: 2016-12-29
The Empire Pack is a variation of RIG operated by a load seller. It's being fed by many traffic actors
Retired - Last seen: maybe end of 2013
Glazunov is an exploit kit mainly seen behind compromised website in 2012 and 2013. Glazunov compromission is likely the ancestor activity of what became EITest in July 2014. Sibhost and Flimkit later shown similarities with this Exploit KitRead More ›
Microsoft Word Intruder is an exploit kit focused on Word and embedded flash exploits. The author wants to avoid their customer to use it in mass spam campaign, so it's most often connected to semi-targeted attacks
Job314 - Neutrino Rebooted - Neutrino-v - Retired - Last seen 2017-04-10
Neutrino Exploit Kit has been one of the major exploit kit from its launch in 2013 till september 2016 when it become private (defense name for this variation is Neutrino-v). This EK vanished from march 2014 till november 2014.
RIG 3 - RIG-v - RIG 4 - Meadgive - Active
RIG is an exploit kit that takes its source in Infinity EK itself an evolution of Redkit. It became dominant after the fall of Angler, Nuclear Pack and the end of public access to Neutrino. RIG-v is the name given to RIG 4 when it was only accessible by "vip" customers and when RIG 3 was still in use.
Sednit EK - Active
Sedkit is the exploit kit used by APT28
ThreadKit is the name given to a widely used Microsoft Office document exploit builder kit that appeared in June 2017