Chris Wakelin

[Kafeine @kafeine]

Silverlight (CVE-2013-0074) is now targeted in Exploit Kits (Angler EK) http://t.co/1ItTnT4E5P via&thx @EKwatcher

[Chris Wakelin @EKwatcher]

Looks like "Angler EK" is including a Silverlight Exploit - in preference to ones for vulnerable Flash and Java

[Kafeine @kafeine]

CVE-2013-2465 integrating Exploit Kits : spotted in Styx "Kein" - http://t.co/IopvyKIfTM

[Kafeine @kafeine]

Sakura EK too : CVE-2013-2423 && Security Bypass (!!) http://t.co/2LEJMC1SVw

[Kafeine @kafeine]

Aouch !! There is no Security Warning. Seems like Neutrino is implementing : http://t.co/fc2pUvFdqn for sure : "пробив приятно поднялся"

[Chris Wakelin @EKwatcher]

@TimoHirvonen - It's a888263ef565023a13f01083af3cb5804beb9cf0a87f8373f353672845abd776
Someone's already uploaded it to VirusTotal

[Chris Wakelin @EKwatcher]

RT @TimoHirvonen: New Java exploit for CVE-2013-2423 has been introduced to RedKit.

In Metasploit and Cool EK too.

[Chris Wakelin @EKwatcher]

@FGW - Don't "Ask Sarah" - it's serving up a "Glazunov" Java exploit for at least the last week (e-mailed them -> case 7004099 on 6th March)

[Kafeine @kafeine]

CVE-2013-1493 (jre 7<=15 & 6 <=41) spotted in Cool EK http://t.co/b8hbPQvg4b cc @mihi42 @node5 @ekwatcher

[Kafeine @kafeine]

Hello Neutrino ! (yes, one more Exploit Kit) http://t.co/AcdWflPwK1

[Kafeine @kafeine]

Cool EK += CVE-2013-0634 and Miss LadyBoyle (dropping Reveton)

[Chris Wakelin @EKwatcher]

Looks like Cool EK now has one of the Java 7u11 exploits - issue 52 in http://t.co/UFCoQs4G

[Chris Wakelin @EKwatcher]

Looks like Cool EK is also including the IE 8 0-day exploit (CVE-2012-4972) similar to the one in Metasploit

[Kafeine @kafeine]

The 0 day is everywhere
Cool EK, Blackhole EK, Nuclear Pack and Redkit. Will publish all data soon

[Kafeine @kafeine]

Java 0 day Spotted and massively exploited in the Wild! Disable Java plugin now (or remove it) http://t.co/1W2Ksjmg

[briankrebs @briankrebs]

Russian forensics firm Group-IB says a new exploit being sold for $50,000 bypasses sandbox in Reader X, XI http://t.co/87TTeaIi

[Chris Wakelin @EKwatcher]

Looks like Blackhole/Cool EK have a working Java 1.7.0_07 exploit. Plus they've changed the payload and PDF URIs - lots of ":". Patch Java!

[Chris Wakelin @EKwatcher]

RT @wopot: Not A Very Nice Pack http://t.co/SoYam3N4 - we've been calling this Scalaxy at #EmergingThreats

[Chris Wakelin @EKwatcher]

@kafeine Thanks! Spookily I've just seen the first RedKit in a month. URLs like /hmod.html /332.jar /887.jar /987.pdf /33.html /41.html

[Chris Wakelin @EKwatcher]

@kafeine Calling this SofosFO for months in @EmergingThreats after http://t.co/de3zaFWN The 24-hex strings /4ff... etc. stayed the same