Exploit Kit Activity Roundup Spring 2019

This Zscaler ThreatLabZ quarterly roundup (Mar–May 2019) documents active exploit kit activity — notably RIG, newly observed Underminer and Spelevo — that use malvertising and legacy browser/Flash vulnerabilities (multiple CVEs) to deliver payloads such as SmokeLoader, AZORult, and bootkit malware; it also details router-targeting DNS-hijacking scripts, provides IOCs and infection-chain screenshots, and recommends blocking untrusted third-party scripts and keeping software patched.