Fiesta Exploit Kit: Live Infection

This report details active Fiesta exploit kit campaigns that leveraged compromised websites (e.g., orpi.com, interfacelift.com, soyentrepreneur.com) to redirect victims to EK landing pages which probe for Silverlight/Flash/Java/Reader plugins and exploit known CVEs to deliver payloads (rtu.swf, rtp.xap, ianlar.jar, Ianlar.pdf). Post-exploitation activity observed includes installation of a Zemot click-fraud Trojan and connections to multiple malicious domains and IPs acting as C2 or click-fraud infrastructure; the report provides numerous indicators of compromise and examples of the EK request patterns.