Nuclear Exploit Pack Getting More Aggresive

The report documents a recent surge in activity from the Nuclear Exploit Pack exploit kit: redirects lead to an obfuscated Java payload that exploits CVE-2013-2460 to run a malicious JAR which downloads and executes a variety of malware (Spyeye/Zbot, ransomware, Caphaw, keyloggers, proxy trojans, spam bots). Researchers observed thousands of transactions, identified hosting IPs (primarily in Russia), collected 19 dropped samples with VirusTotal links, and recommend disabling Java to mitigate risk.