An exploit kit is a ready-made toolkit hosted on a malicious web server that automatically scans visitors’ browsers for vulnerabilities and exploits them to install malware.
How exploit kits work
An exploit kit attack usually has three stages:
- Traffic – victims are redirected to the kit’s landing page from compromised websites or through malvertising, often via several hops that filter out researchers and bots.
- Profiling – the landing page fingerprints the browser, operating system and plugins such as Flash, Java or Silverlight.
- Exploitation – the kit chooses a matching exploit, achieves code execution and silently downloads the payload: ransomware, a banking trojan or a loader.
The whole process is a classic drive-by download: the victim only has to visit a page. Kits were rented to criminals as a service, with dashboards showing infection statistics, and their authors quickly added new browser bugs – sometimes even zero-day exploits.
Why exploit kits matter
In the early 2010s exploit kits were one of the main ways malware reached home and office computers. Blackhole dominated until its author, known as Paunch, was arrested in Russia in 2013. Angler, Nuclear, Neutrino, RIG and Magnitude followed; Angler disappeared in 2016 after Russian police arrested members of the Lurk gang. Activity then declined sharply as browsers became harder to exploit, automatic updates spread and Adobe Flash reached end of life in 2020. Kits such as RIG and Magnitude survived longer by targeting outdated Internet Explorer installations.
How to protect against exploit kits
- Keep browsers and operating systems updated automatically and remove obsolete plugins and browsers.
- Use ad blocking and DNS filtering to cut off malvertising chains.
- Apply exploit protection features and endpoint security that monitor browser child processes.
- Patch web servers to avoid hosting injected redirect code.
