Counter-Infiltration: Future-Proof Counter Attacks Against Exploit Kit Infrastructure
summary
Team redeploys leaked kits (33 collected, four fully rebuilt) in a lab and identifies concrete choke points: an unauthenticated API that allows API exhaustion attack yielding 313 proxy IPs in one month (peaks ~25/day), weak panel logic that revealed hidden panel IPs behind Cloudflare, and exposed fingerprint server addresses. Using those flaws they can deplete proxies, enumerate users and stats (21 users analyzed, >900k access records with >100k infections) and trace operator revenue (~US$7.8M), demonstrating practical takedown routes.
AI-written summary · about
chapters (22)
- 0:00Intro
- 2:11Motivation
- 6:17Method
- 8:25Outline
- 10:03Panel Server (Admin)
- 11:34Panel Server (User)
- 12:39API for Proxy
- 13:59Inside the Leaked DB
- 25:40API Link
- 30:39Decoying Proxies
- 37:12Reveal the Hidden IP
- 39:42blackhat Peaking Attackers
- 43:51black hat RIG 4.0 - Attack Summary
- 44:26The Rich?
- 47:14black hat BEPS - Attack Infrastructure
- 49:27black hat Hunter - Attack Infrastructure
- 50:46black hat Neptune - Attack Infrastructure
- 51:40Future Possibilities
- 52:24Leaked Exploit Kits
- 52:45black hat Old Days vs New Days
- 53:12Code Reuse
- 54:01Conclusion
related talks
50mThe Anatomy of Cloud Attacks
43m"A rootkits writer’s guide to defense"
29mHook, Line, and Tinker: A Dive into Phishing Campaign Sites
50mTowards a Holistic Approach in Building Intelligence to Fight Crimeware
40mYou have a security problem - your users
42mTracking Attackers in Open Source Supply Chain Attacks: The New Frontier
49mAttacking and Detecting Attacks on Kubernetes Clusters
46mAttacks, Lies and the Underground World