Avatar

This post authored by Steve Poulson with contributions from Nick Biasini.

Exploit kits are constantly evolving and changing. We recently wrote about some subtle Angler changes but then Angler changed drastically on March 8. In this blog post, we will briefly cover these changes, examining different characteristics of the URL structure for Angler and the origins of the words being leveraged to create them.

New Angler
Beginning on March 8, Talos noticed some major changes to the URL structure for Angler. These changes were drastic and have altered every part of the URL for the landing pages. Let’s first look at the old syntax:
e.serenawilliamsbeauty.com/forum/view.php?forum_id=t4g&id=tnm9epz5bt3cua9snw8b1etdv2fd46zmo5-6s4n94yeh023g_y8ym2896c-0fnmmzxpec27qye_x2dswec8dgxxapds5ngbt3


Authors

Talos Group

Talos Security Intelligence & Research Group