Lord Exploit Kit

The Lord Exploit Kit is a threat that abuses vulnerabilities in software, such as Flash, for infecting your PC. Its payload is configurable and can include backdoor Trojans, file-locker Trojans, and other software that can collect or damage information. Maintaining appropriate Web-browsing security guidelines will lower your risk of endangerment, and most anti-malware products should block a Lord Exploit Kit attack automatically.

A Rising Lord in the EK Sector

The EK sector's competitive nature is well-demonstrated with the campaigns piggybacking off of threats like Asia's KaiXin Exploit Kit, the Fallout Exploit Kit, and a newcomer: the Lord Exploit Kit. While the third EK's deployment is much lesser in quantity, its attacks only are just starting, and malware experts expect more to come from its active administrators. This Flash-abusing threat is playing a Trojan delivery-man for Trojans that might lock files or create backdoors on your computer.

The Lord Exploit Kit's attacks exposed themselves to the cyber-security industry through a series of malvertising (or 'corrupted advertising') elements on a PopCash ad network. The EK uses CVE-2018-15982, a Flash vulnerability for versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier, for executing remote code. Malware experts can only verify the EK's delivering two Trojans afterward, although EKs are highly-adjustable:

• Backdoor.Ratenjay (njRAT) is a Remote Access Trojan. Besides providing attackers with user-friendly backdoor access to your PC, it can conduct keylogging or screen-capturing attacks, or link the computer to a botnet.
• The ERIS Ransomware can encrypt files on your computer, including documents and other media, as well as lesser-used formats like Oracle package specifications. It tries to ransom the unlocking service with a text message to the victim.

Blocking His Lordship's Advertisement Invasions

Part of what differentiates a proper Exploit Kit, like the Lord Exploit Kit, from a more basic form of Web-based attack is the dynamic elements. These traits can include compensating for variability in the victim's software vulnerabilities, tracking geolocation, and changing the payload for different campaigns. The Lord Exploit Kit is, accordingly, capable of delivering more threats than just those noted above, and its threat actor is demonstrating typical responsiveness in the EK business by changing the Trojan 'delivery' on a sometimes-daily basis.

Advertising blockers are potential defenses against compromised ad networks like PopCash, along with default browser features like disabling JavaScript, Flash and pop-ups. Users can further protect themselves while browsing the Web by having anti-malware tools that can detect unsafe domains and script activity related to drive-by-downloads. Lastly, software always should be kept as up-to-date as possible for cutting down on vulnerabilities like CVE-2018-15982.

Since the Lord Exploit Kit is a Web-based threat, users shouldn't require removing it from their personal computers. They still can use anti-malware programs for deleting the Trojans that the Lord Exploit Kit drops, blocking attacks, or identifying compromised code on websites.

The Lord Exploit Kit is a small and narrow example of royalty among EKs. Its admins are, however, busying themselves at changing these humble beginnings, to the disadvantage of Web surfers everywhere.