An Update On Nuclear (Reverse) Engineering

This analysis details a Nuclear exploit-kit campaign that compromises WordPress sites to serve obfuscated landing pages which probe browser/Flash versions and exploit CVE-2015-5122, CVE-2015-5560 (Flash) and CVE-2014-6332 (IE). Post-exploitation payloads observed include the Fareit infostealer and Troldesh ransomware; the report documents TTPs (iframe injection, obfuscation, DH/XTEA protections), C2-evasion techniques including Tor and blend-in HTTP POSTs, and specific IOCs such as [email protected], [email protected] and a4yhexpmth2ldj3v.onion.