International Council Of Women Site Leading To Nuclear & Kelihos
ID: 114f5de8-4706-5516-96a4-4f6708d3ef92
STIX ID: report--114f5de8-4706-5516-96a4-4f6708d3ef92
Feed Name: Zscaler Security Research Blog
Threat Score
Zscaler ThreatLabZ observed a compromised International Council of Women site redirecting users to a Nuclear Exploit Kit that, via obfuscated JavaScript and a Flash exploit, delivered a Kelihos information-stealing bot; the report provides payload analysis, targeted applications and browsers, persistence via WinPcap, C2 communication details (Blowfish-encrypted HTTP), and several IP-based download URLs as IOCs.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.