Skip to main content

Terror Exploit Kit Evolving Threat

We previously wrote about the Terror exploit kit earlier this year.
Threat ID:
CC-1443
Category:
Exploit
Threat Severity:
Medium
Threat Vector:
Hacking tool
Published:
1 June 2017 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

We previously wrote about the Terror exploit kit earlier this year.

Affected platforms

The following platforms are known to be affected:

Microsoft Windows

Microsoft Windows - all versions

Threat details

Terror has since evolved and has become more sophisticated. It is now using anti-analysis techniques, making it more difficult for researchers to analyse.

Terror is able to detect system settings and determines which exploit would be most likely to have success depending on the operating system, browser, patch level and installed plugins.

Terror chain of infection:

  • The infection begins with a compromised website redirecting users to the Terror landing page.
  • The landing page is filled with random text and obfuscated JavaScript code which is used to evaluate the browser environment and any plugins in use.
  • The landing page will then generate a HTTP POST request and a response will come from a HTML page including a plain-text URL outlining which vulnerabilities are to be exploited.
  • After the vulnerability has been exploited, attempts will be made to download the final payload.
  • After successful exploitation, a JScript file is written to disk and is executed by the command line.
  • The script then downloads an encrypted binary stream from the landing page, decodes it and saves it to disk before finally executing it.

Remediation advice

For an organisation to be in the best possible position to protect itself from the Exploit Kit, it should consider:

Remediation steps

Type Step
  • Ensure all software is kept up-to-date, including application of regular monthly patches
  • The use of a robust security solution including the use of an intrusion detection and intrusion prevention system
  • Up-to-date anti-virus software providing the latest malware signatures
  • Educating staff on the dangers of clicking on banners

Last edited: 17 February 2020 11:40 am