Top Exploit Kit Activity 2017

This Zscaler ThreatLabZ roundup details exploit kit activity from March–June 2017: RIG remains the most active EK distributing Cerber ransomware, cryptominers, and Dreambot (with Tor support); Magnitude runs malvertising targeting Taiwan to deliver Cerber; Terror employs fingerprinting and drops miners, loaders (Andromeda, Smoke Loader) and Win32/Tofsee. The report also notes Neutrino's return and declining activity for KaiXin and Sundown, and describes techniques such as browser/Flash fingerprinting, redirect chains, and region-based filtering used to evade defenses.