Not quite the average exploit kit: Zuponcic

FanJ · Dec 19, 2013

Fox-IT blog:
http://blog.fox-it.com/2013/12/19/not-quite-the-average-exploit-kit-zuponcic/

Posted on December 19, 2013 by ydklijnsma

A couple of weeks ago at the FOX-IT SOC, we noticed Zuponcic attempting to infect one of our clients protected networks. The incident was caused by a person visiting the website of Suriname’s Ministry of Finance, minfin.sr.

This post connects three recent developments in the realm of malware infections: .htaccess server compromise, the Zuponcic exploit kit and the Ponmocup botnet. It seems that the defacto standard of exploit kits is getting competition. Understanding how this exploit kit works will give you a better chance of defending against it and for identifying the .htaccess compromise on your server.

Looking back at clients that have been affected by Zuponcic there had been a significant increase in compromised websites serving this kit starting June 2012, including some relatively big Dutch websites along the way, such as iphoneabonnementen.nl and tboek.nl.
This is interesting as websites hosting this kit have to be compromised due to the nature of the redirects. It seems the trend of using compromised website to attack users continues. As a sidenote, Zuponcic is not the actual name of this exploit kit, its real name is unknown. The first website it was found redirecting on was zuponcic.com, this is where the name came from.
Click to expand...

Read more at that link.

Log in or Sign up

Not quite the average exploit kit: Zuponcic

FanJ Updates Team

Log in or Sign up

Not quite the average exploit kit: Zuponcic

FanJ Updates Team

Useful Searches