Not quite the average exploit kit: Zuponcic

This Fox-IT analysis describes the Zuponcic exploit kit campaign (circa 2012–2013) that used .htaccess compromises on high-traffic sites to selectively redirect search-engine referrals to landing pages which deployed signed Java applets or offered socially engineered ZIP/JAR downloads to install the Ponmocup botnet payload; the report includes delivery flowcharts, stolen/used certificate fingerprints, and numerous sample file hashes as IOCs.