A quick look at recent malvertising exploit chains

This Zscaler ThreatLabZ update examines recent activity and evolution of the Sundown and RIG exploit kits, detailing a malvertising chain that delivered both kits, changes in redirector and hosting infrastructure (including domain shadowing), and updates to landing-page obfuscation and payload delivery (notably the use of CVE-2016-0189, dynamic XOR obfuscation, and extended-ascii/base64 encodings). The report highlights RIG's growing dominance since Angler/Nuclear disappeared and documents observable indicators and techniques used in recent campaigns, committing to continued monitoring.