XXX - AEK - Axpergle - Status: Retired - Last seen: 2016-06-07
The Angler Exploit Kit has been the most popular and evolved exploit kit from 2014 to middle of 2016. There was several variations. The historical "indexm" variant was used to spread Lurk. A vip version used notabily to spread Poweliks, the "standard" commercial version, and a declinaison tied to load selling (mostly bankers) that can be associated to EmpirePPC
Status: Retired
Archie EK
Stegano EK - Status: Active
Astrum Exploit Kit is a private Exploit Kit used in massive scale malvertising campaigns. It's notable by its use of Steganography
Status: Retired - Last seen 2017-07-07
Bingo EK is the name chosen by the defense for a Fiesta-ish EK first spotted in March 2017 and targetting at that times mostly Russia.
Read More ›Sundown-b - Status: Retired
Bizarro Sundown appears to be a fork of Sundown with added anti-analysis features
BHEK - Status: Retired - Last seen: 2013-10-07
The BlackHole Exploit Kit has been the most popular exploit kit from 2011 to 2013. Its activity stopped with Paunch's arrest (all activity since then is anecdotal and based on an old leak)
BL - BL2 - Status: Retired
Bleeding Life is an exploit kit that became open source with its version 2
CEK - Styxy Cool - Status: Retired - Last seen: 2013-10-07
The Cool Exploit Kit was a kind of BlackHole VIP in 2012/2013
RouterEK - Status: Active
DNSChanger Exploit Kit is an exploit kit targeting Routers via the browser.
Sednit RTF EK - Status: Active
DealersChoice is a Flash Player Exploit platform triggered by RTF.
Status: Retired - Last seen 2017-11-10
Disdain EK has been introduced on underground forum on 2017-08-07. The panel is stolen from Sundown, the pattern are Terror alike and the obfuscation reminds Nebula.
RIG-E - Status: Retired - Last seen: 2016-12-29
The Empire Pack is a variation of RIG operated by a load seller. It's being fed by many traffic actors
Status: Active
Fallout Exploit Kit appeared at the end of August 2018 as an updated Nuclear Pack featuring current exploits seen in competiting Exploit Kit.
NeoSploit - Fiexp - Status: Retired - Last Seen: beginning of 2015-07
Fiesta Exploit Kit
FlashEK - SafePack - CritXPack - Vintage Pack - Status: Retired - Last seen: middle of 2015-04
FlashPack EK got multiple fork. The most common variant seen was the standalone Flash version
Status: Active
GhostDNS appears to be a variant of the Novidade Router EK familly
Status: Retired - Last seen: maybe end of 2013
Glazunov is an exploit kit mainly seen behind compromised website in 2012 and 2013. Glazunov compromission is likely the ancestor activity of what became EITest in July 2014. Sibhost and Flimkit later shown similarities with this Exploit Kit
StampEK - SofosFO - Status: Active
GrandSoft Exploit Kit was a quite common exploit kit used in 2012/2013. Disappeared between march 2014 and September 2017
Sundown-GF - Status: Active
GreenFlash Sundown is a variation of Bizarro Sundown without landing
Status: Retired - Last seen: 2015-07
Hanjuan EK was a one actor fed variation of Angler EK used in evolved malvertising chain targeting USA. It has been using a 0day (CVE-2015-0313) from beginning of December 2014 till beginning of February 2015. Some clues let think it might be a "grand-child" of Robopak.
High Load - Status: Retired - Last seen: 2014-04
Himan Exploit Kit
3ROS Exploit Kit - Status: Retired - Last seen 2017-02-06
Hunter EK is an evolution of 3Ros EK
Status: Retired
Impact EK
Redkit v2.0 - Goon - Status: Retired - Last seen: 2014-07
Infinity is an evolution of Redkit
CK vip - Status: Active
Kaixin is an exploit kit mainly seen behind compromised website in Asia
Status: Active
LCG Kit is a weaponized document builder.It's unusual in that the code is highly obfuscated using polymorphic shellcode and a Linear Congruential Generator (LCG) -- an algorithm to generate a sequence of pseudorandom numbers -- to encrypt the final stage of the code, including the payload locations.
Status: Unknown - Last seen: 2014-03
Lightsout Exploit Kit has been used in Watering Hole attack performed by the APT Group havex
Status: Active
Microsoft Word Intruder is an exploit kit focused on Word and embedded flash exploits. The author wants to avoid their customer to use it in mass spam campaign, so it's most often connected to semi-targeted attacks
Popads EK - TopExp - Status: Active
Magnitude EK
Status: Retired - Last seen 2017-03-09
Nebula Exploit Kit has been built on Sundown source and features an internal TDS
Job314 - Neutrino Rebooted - Neutrino-v - Status: Retired - Last seen 2017-04-10
Neutrino Exploit Kit has been one of the major exploit kit from its launch in 2013 till september 2016 when it become private (defense name for this variation is Neutrino-v). This EK vanished from march 2014 till november 2014.
CottonCastle - Status: Unknown - Last seen: 2015-11
Niteris was used mainly to target Russians.
Status: Active
Novidade Exploit Kit is an exploit kit targeting Routers via the browser seen mostly attacking Brazil
NEK - Nuclear Pack - Spartan - Neclu - Status: Retired - Last seen: 2015-04-30
The Nuclear Pack appeared in 2009 and has been one of the longer living one. Spartan EK was a landing less variation of Nuclear Pack
PEK - Status: Retired
Phoenix Exploit Kit
PEP - Status: Retired
Private Exploit Pack
RIG 3 - RIG-v - RIG 4 - Meadgive - Status: Active
RIG is an exploit kit that takes its source in Infinity EK itself an evolution of Redkit. It became dominant after the fall of Angler, Nuclear Pack and the end of public access to Neutrino. RIG-v is the name given to RIG 4 when it was only accessible by "vip" customers and when RIG 3 was still in use.
Status: Retired
Redkit has been a major exploit kit in 2012. One of its specific features was to allow its access against a share of a percentage of the customer's traffic
SPL_Data - SPLNet - SPL2 - Status: Retired - Last seen: 2015-04
SPL exploit kit was mainly seen in 2012/2013 most often associated with ZeroAccess and Scareware/FakeAV
Read More ›Status: Retired - Last seen: 2013-09
Sakura Exploit Kit appeared in 2012 and was adopted by several big actor
Sednit EK - Status: Active
Sedkit is the exploit kit used by APT28
Status: Active
Spelevo is an exploit kit that appeared at the end of February 2019 and could be an evolution of SPL EK
Status: Retired - Last seen: 2014-06
Styx Exploit Kit
Beps - Xer - Beta - Status: Retired - Last seen 2017-03-08
Sundown Exploit Kit is mainly built out of stolen code from other exploit kits
Sundown-Pirate - CaptainBlack - Status: Active
Sundown-P/Sundown-Pirate is a rip of Sundown seen used in a private way (One group using it only) - First spotted at the end of June 2017, branded as CaptainBlack in August 2017
SWO - Anogre - Status: Retired - Last seen: 2015-04-05
Sweet Orange
Status: Active
Taurus Builder is a tool used to generate malicious MS Word documents that contain macros. The kit is advertised on forums by "badbullzvenom".
Blaze EK - Neptune EK - Status: Active
Terror EK is built on Hunter, Sundown and RIG EK code
Status: Active
ThreadKit is the name given to a widely used Microsoft Office document exploit builder kit that appeared in June 2017
Status: Active
Underminer EK is an exploit kit that seems to be used privately against users in Asia. Functionalities: browser profiling and filtering, preventing of client revisits, URL randomization, and asymmetric encryption of payloads.
Status: Active
VenomKit is the name given to a kit sold since april 2017 as "Word 1day exploit builder" by user badbullzvenom. Author allows only use in campaign. Is used for instance by the "Cobalt Gang"
Status: Retired - Last seen: 2013-12
WhiteHole Exploit Kit appeared in January 2013 in the tail of the CVE-2013-0422
Read More ›