Key takeaway
Align browser and plugin inventory with automatic updates, remove unnecessary components and restrict risky execution. Give vulnerabilities with known active exploitation separate priority.
How an exploit kit delivers malware
An exploit kit automates checking a website visitor’s software weaknesses and delivering malicious payloads. A chain can involve a compromised site or malicious ad, redirects, device profiling, a matching exploit and payload delivery. Infection may occur without the user choosing a download. Outdated browsers and plugins keep already-patched weaknesses reachable; some campaigns also use newly discovered vulnerabilities.
| Chain stage | Defensive question | Useful evidence |
|---|---|---|
| Entry and redirect | Which site or advertising path reached the device? | Correlate browser, DNS and proxy events by time. |
| Vulnerable software and execution | Was affected software present and was the control active? | Check versions, patch state and endpoint process events. |
| Payload and impact | What activity followed? | Combine alerts, communications and recovery checks. |
Historical example: Magnitude
Kaspersky’s 2020 research described Magnitude delivering ransomware through malvertising in the Asia Pacific region. Matching an exploit to an outdated browser and reaching the operating system illustrates why browser support, patching and endpoint controls work together. Examine device support and update coverage across the stages of this chain.
Historical example: Nuclear
Talos’s April 2016 Nuclear investigation described Flash exploitation followed by a Tor client and a secondary payload. Obfuscation and redirects show why blocking one visible URL may leave the rest of an infection chain unexamined. Retire obsolete plugins and correlate web, network and endpoint evidence to investigate entry and payload delivery.
Historical example: Fallout
FireEye’s 2018 Fallout investigation documented a malvertising campaign delivering GandCrab ransomware. Target profiling, redirects and exploitation precede the final payload. Preserve browser and advertising-traffic signals in investigations rather than looking only for the eventual ransomware file. These intermediate stages help reconstruct how the device was reached and which controls need improvement.
Historical example: RIG
Cisco Talos’s 2016 RIG analysis showed a chain from compromised web content to exploit delivery. Hidden iframes, changing domains and obfuscation can alter visible indicators. Correlate site, DNS, proxy and endpoint events on a timeline, supplementing file and domain indicators with behavior and software-version evidence. Investigate the path as well as the payload.
Payloads and the service model
Exploit delivery can support ransomware, information stealers, banking trojans, bots or miners. Kits and campaign infrastructure can be supplied as criminal services, with operator objectives determining the final payload. Build protection around entry, execution, communication and data impact rather than a single malware-family name, and keep threat intelligence connected to observed evidence.
Patching, exposure reduction and response
Update browsers, operating systems and applications, and retire obsolete plugins and systems. Use CISA KEV and vendor information with asset criticality and exposure to prioritize. Test web and endpoint controls, segmentation and backup recovery. Isolate suspicious devices under the response procedure, preserve evidence and close the entry weakness before restoration. Share relevant indicators through approved incident channels.