Nuclear Exploit Kit Analysis
No activities identified yet
IOC - Indicator of Compromise (11)
These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.
| ID | IP address | Hostname | Actor | Campaigns | Type | Confidence |
|---|---|---|---|---|---|---|
| 1 | 41.77.114.188 | Nuclear Exploit Kit | verified | High | ||
| 2 | 67.212.169.38 | 38.169.212.67.unassigned.ord.singlehop.net | Nuclear Exploit Kit | verified | High | |
| 3 | 87.107.133.83 | Nuclear Exploit Kit | verified | High | ||
| 4 | XX.XXX.XXX.XXX | xxxxxx | Xxxxxxx Xxxxxxx Xxx | verified | High | |
| 5 | XXX.XX.XX.XXX | xxx.xx.xxxxxxx.xxx | Xxxxxxx Xxxxxxx Xxx | verified | High | |
| 6 | XXX.XXX.XX.XXX | xxxx.xxxx.xxx.xxxxxxxxx.xxx | Xxxxxxx Xxxxxxx Xxx | verified | High | |
| 7 | XXX.XXX.XX.XX | Xxxxxxx Xxxxxxx Xxx | verified | High | ||
| 8 | XXX.X.XXX.XXX | xx.xx.xxxx.xxx.xxxxxx.xx-xxxxxxx.xxx | Xxxxxxx Xxxxxxx Xxx | verified | High | |
| 9 | XXX.XXX.XXX.XXX | Xxxxxxx Xxxxxxx Xxx | verified | High | ||
| 10 | XXX.XX.XX.XX | xxxx.xxxx.xxx.xx | Xxxxxxx Xxxxxxx Xxx | verified | High | |
| 11 | XXX.XXX.XXX.XXX | Xxxxxxx Xxxxxxx Xxx | verified | High |
References (4)
The following list contains external sources which discuss the actor and the associated activities:
- https://blog.malwarebytes.com/threat-analysis/2015/04/a-history-lesson-brought-to-you-by-the-nuclear-exploit-kit/
- https://blog.talosintelligence.com/2015/06/domain-shadowing-goes-nuclear-story-in.html
- https://github.com/vuldb/cyber_threat_intelligence/tree/main/actors/Nuclear%20Exploit%20Kit
- https://isc.sans.edu/forums/diary/Nuclear+EK+traffic+patterns+in+August+2015/20001/