Cybercriminals are using an exploit kit called Neptune to drive malvertising campaigns. According to security firm FireEye, Neptune is a resurgence of an older exploit kit known as Sundown, or Terror. But the new variant has some different internals and a Monero mining payload.

How Neptune Works

The newest attack variants for Neptune features changes in uniform resource identifier (URI) patterns, landing pages, the actual malvertising used and the specific payloads it carries. FireEye reported that most of the ads linked to this campaign were observed on high-traffic torrent and multimedia hosting sites.

Malicious actors used a legitimate pop-up ad service via Alexa’s Top 100 to push out fake advertisements for hiking clubs. Landing page redirects from the domains associated with these ads use 302-style redirects. The pages that the victims are redirected to look legitimate to the casual observer — except for the URL changes.

The landing page that actually triggers the Neptune exploit kit will then redirect the victim to other Internet Explorer and Adobe Flash exploit links. Before it does that, however, it checks the Flash versions that have been installed on the victim’s machine.

The eventual payload is a Monero miner, which has an $86 per-unit value at this time. Once activated, the payload tries to first connect to a mining website. It then conducts a login attempt to use the CPUminer service with a login email that purports to be from monsterkill20@mail.com.

Exploit Kit Malvertisements and Security

SecurityWeek observed that the campaign’s major targets include South Korea (29 percent), Europe (19 percent), Thailand (13 percent), the Middle East (13 percent) and the U.S. (10 percent).

The vulnerabilities that Neptune takes advantage of were disclosed between 2014 and 2016, so they are not brand new. Contemporary patching should have already taken care of them. Failing to update software to the latest version will put users at risk, especially considering that exploit kit malvertisements can secretly download arbitrary payloads.

Security managers should stay vigilant when it comes to variants of older threats, since users may not ever be aware that they have been affected. Monitoring any unusual external internet or CPU activity can help to identify the victims of this stealthy exploit kit.