What it is
An exploit kit (EK) sits at a 'gate' URL to which legitimate sites redirect — often via a malvertising chain or a compromised JS dependency. It fingerprints the browser, OS, and plugin versions, then serves the CVE most likely to succeed. If exploitation succeeds, a loader is dropped (banker, ransomware, infostealer). Although volumes are lower than the 2014–2017 peak, descendants of RIG, Fallout, and Underminer are still encountered.
Real-world examples
- RIG EK
- Fallout EK
- Magnitude EK
- Underminer EK
How ExploitShield detects it
ExploitShield captures the full redirect chain and the gate's fingerprinting JS. Because the scanner operates as a real, instrumented browser, the EK serves it the exploit payload, which is then saved as evidence and compared against current CVE signatures.