Neutrino Exploit Kit

The Neutrino Exploit Kit is a configurable package of exploits and related attacks that install malicious software without the consent of the victim – in a technique known as a drive-by-download attack. Although the Neutrino Exploit Kit is similar to previous exploit kits, SpywareRemove.com malware research team and others in the PC security industry have noted the Neutrino Exploit Kit's uptick in sophistication, with features that allow the Neutrino Exploit Kit to steal limited amounts of information in its initial attacks, evade anti-virus software and filter traffic for preferential targets. Currently, the Neutrino Exploit Kit appears to be used for installing Police Ransomware Trojans, but the Neutrino Exploit Kit also may install other forms of malware and should be considered an ongoing threat to your computer. Although there's no need to remove the Neutrino Exploit Kit from your computer (since it's not installed on your hard drive), you always should use anti-malware software as necessary for uprooting and removing malware that's installed by the Neutrino Exploit Kit.

The Neutrino Exploit Kit: A Not-So-Neutral Delivery for Your Computer

The Neutrino Exploit Kit is more recent and slightly more advanced than many past exploit kits, but still uses the same basic mechanisms as similar exploit kit-based attacks. By being embedded in a web page, the Neutrino Exploit Kit can launch concealed attacks against any unprotected web browser that loads that web page (where 'unprotected' can be defined as having JavaScript enabled, having Flash enabled, being unpatched, using poor security settings, etc). The Neutrino Exploit Kit is sold on a rental basis to other criminals, who can use their very own copy of the Neutrino Exploit Kit to install whatever malware they wish to proliferate.

While the Neutrino Exploit Kit isn't limited to installing a specific type of PC threat, the Neutrino Exploit Kit currently is involved in distributing a Windows-locking Police Trojan that's identified as TROJ_RANSOM.NTW. TROJ_RANSOM.NTW will inject its malicious code into a normal Windows process, thereafter displaying a fake warning message while it blocks you from using any other software. Supposedly, TROJ_RANSOM.NTW will reverse this lock if you pay a fine – which is strongly discouraged and an improper response to any form of Police Ransomware.

While it installs TROJ_RANSOM.NTW, the Neutrino Exploit Kit also may gather and transmit basic information about your PC (based on your web browser's add-ons). This information then can be exploited and used to attack your computer in additional ways.

Saving Your Browser from a Spin on the Neutrino Exploit Kit

The Neutrino Exploit Kit's basic methodology is similar to that of past exploit kits like the Sweet Orange Exploit Kit, Blackhole Exploit Kit, the Whitehole Exploit Kit and the Stamp EK. Advanced anti-malware products may be able to detect and block the Neutrino Exploit Kit's attacks, but since the development for the Neutrino Exploit Kit is ongoing, using updated security software can be considered essential for an adequate defense.

Of course, using strong security settings can help your browser to block the content that includes the Neutrino Exploit Kit by default. Since the Neutrino Exploit Kit has been seen using two separate JavaScript vulnerabilities, SpywareRemove.com malware researchers particularly stress that you disable JavaScript or use other JavaScript-specific precautions.

Avoiding suspicious links and redirects to unusual sites also should be used as a primary defense against the Neutrino Exploit Kit, but it should be noted that many sites that host exploit kits are hacked, rather than intentionally malicious.

Technical Details