Connect with us

Hi, what are you looking for?



RIG Exploit Kit Exposes Millions to SmokeLoader Backdoor

The RIG exploit kit (EK), currently one of the most popular crimekits infecting systems around the world, was recently observed in a campaign that potentially impacted millions of users, exposing them to the SmokeLoader (aka Dofoil) malware.

The RIG exploit kit (EK), currently one of the most popular crimekits infecting systems around the world, was recently observed in a campaign that potentially impacted millions of users, exposing them to the SmokeLoader (aka Dofoil) malware.

Now that the Angler EK is gone, other threats in the segment are trying to fill the void, and RIG is one of them, although the Neutrino EK appears to have taken the reign for the time being (albeit the overall EK traffic is only a fraction of what it once was). According to Forcepoint researchers, a recently observed RIG campaign has targeted the users of Sprashivai[.]ru, a Russian Q&A and social networking site.

The popular website has an estimated 20 million visitors per month, and it makes sense that RIG operators decided to attack it. Over the past couple of years, numerous high-profile sites were targeted by EKs through malvertising or other techniques, in an attempt to expose as many users as possible to the malware they were carrying.

In this instance, the website was compromised by an actor attempting to redirect users to RIG EK via an injected iFrame that loads the RIG EK loading page. Similar to other exploit kits, RIG attempts to leverage outdated, vulnerable software on targeted machines, in this case browser components such as the Adobe Flash Player plugin.

Should it find an exploitable vulnerability, RIG would drop the SmokeLoader malware and then execute it. The entire process is performed in the background, without alerting the user and without requiring interaction, as part of an infection technique called drive-by-download.

Forcepoint’s Nicholas Griffin reveals that RIG was attempting to exploit the CVE-2015-8651 vulnerability in Flash Player that Adobe patched in December last year, via an emergency patch. Apparently, the Russian website has been compromised at least on June 23, and continued to redirect users to the exploit kit on June 29, although the website was notified on the issue on June 27.

The SmokeLoader (aka Dofoil) backdoor, previously associated with the Retefe banking Trojan, is decrypted and executed on compromised machines after the RIG EK would drop a Nullsoft Installer System (NSIS) executable. The delivery method makes it difficult for anti-virus solutions to detect the attack, because NSIS files are legitimate and the scripting ability makes them extremely versatile.

Advertisement. Scroll to continue reading.

The malware attempts to connect to its command and control server while also generating a large number of fake requests to legitimate websites. 

SmokeLoader was mainly designed to download plug-ins that can perform various nefarious operations on the infected computers, ranging from credential stealers, click fraud components, and additional Trojan downloaders.

Written By

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join security experts as they discuss ZTNA’s untapped potential to both reduce cyber risk and empower the business.


Join Microsoft and Finite State for a webinar that will introduce a new strategy for securing the software supply chain.


Expert Insights

Related Content


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...