Seen in the wild: Updated Exploit Kits

Researchers observed a large set of suspicious domains registered to the same WHOIS identity and used to host two exploit kits (NicePack and Sweet Orange). The report documents domain-obfuscation/DGA-like patterns (alphabetic and numeric suffixes), deobfuscated landing-page behavior, targeted client-side vulnerabilities (notably CVE-2012-1723 and CVE-2010-0188), and provides malicious file checksums and sample malicious URLs; WHOIS linkage suggests a single registrant or coordinated actors behind the campaigns.