Drive-by download attacks remain a prominent cyber threat on the Internet today. For instance, we recently spotted new exploit kits such as the Azera, Radio and Lord exploit kits, all found during the summer of 2019. To continuously observe drive-by download attacks, one has to address some problems such as a chain of network access redirection and IP-based access control by ad-networks and exploit kits. It is thus difficult to understand the drive-by download attack landscape.
We have already released open-source tools for exploit kit-related threat analysis. Furthermore, we are operating an integrated platform for continuous observation of exploit kits. The primary objective of this platform is to help establish an independent view of the current cyber threat trends.
In this presentation, we will introduce the design, effectiveness and practical use cases of an automated active analysis platform for malicious traffic. Also, we will show the changes to the threat landscape over the last 10 months by using the results from our platform. In particular, we will talk about how we continue to discover and track new attack campaigns and exploit kits, such as the Fallout and Radio exploit kits.