Security Experts:

Connect with us

Hi, what are you looking for?


Malware & Threats

Exploit for Recent Flash Zero-Day Added to Fallout Exploit Kit

An updated version of the Fallout exploit kit recently emerged with an exploit for a recent Flash zero-day included in its arsenal, Malwarebytes Labs security researchers warn.

An updated version of the Fallout exploit kit recently emerged with an exploit for a recent Flash zero-day included in its arsenal, Malwarebytes Labs security researchers warn.

First detailed in September 2018, the toolkit was observed delivering malware families ranging from ransomware to backdoors, but also fingerprinting the browser profile to identify targets of interest.

The exploit kit (EK) remained active throughout the end of 2018, but its operators took a break in early January, apparently in order to improve their malicious kit. During Fallout’s absence, RIG EK’s activity intensified, Malwarebytes now reveals.

The Fallout EK is distributed via malvertising chains, especially via adult traffic. In attacks observed starting January 15, when the toolkit recommenced activity, GandCrab ransomware was identified as the payload.

One of the most notable additions to Fallout is an exploit for CVE-2018-15982, a vulnerability in Adobe’s Flash Player that leads to remote code execution. Adobe’s patch for the flaw arrived after a threat actor had been abusing it in attacks.

The first EK to implement an exploit for this security bug was Underminer in mid-December 2018, but it appears that Fallout wasn’t too far behind.

Due to the large number of critical vulnerabilities impacting Flash Player, Adobe is moving toward completely killing the plugin in 2020, and major Internet companies are supporting this decision. Later this year, Firefox will disable Flash by default (Chrome has been blocking Flash for two years). 

The re-launched Fallout EK was also observed to include support for encrypted communications (HTTPS) and a new landing page format, and to leverage Powershell to run the final payload. 

The use of Powershell instead of iexplorer.exe is “most likely an attempt at evasion, as traditionally we’d expect the Internet Explorer process to drop the payload,” Malwarebytes says. 

This development is yet again proof that exploit kit developers are continuously monitoring the security vulnerabilities scene to implement new exploits and techniques. 

“In 2018, several zero-days for Internet Explorer and Flash Player were found and turned into easily adaptable proof of concepts. Even though the market share for IE and Flash continues to drop, there are many countries still running older systems where the default browser is Internet Explorer,” Malwarebytes notes. 

Related: Russian Hospital Targeted With Flash Zero-Day After Kerch Incident

Related: Researchers Discover New “Fallout” Exploit Kit

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.