Some domains were abandoned after a single use
The group of cybercriminals behind the Angler browser-based attack managed to compromise registrant accounts from GoDaddy for hosting Flash Player exploits on legitimate websites.
In the past two weeks Adobe was forced to release two out-of-band security updates for Flash Player, removing two zero-day vulnerabilities (CVE-2015-0310 and CVE-2015-0311) that were being exploited in the wild.
About 1,800 legitimate domains used by Angler operators
This week, another security fix is expected, as cybercriminals discovered another zero-day (CVE-2015-0313) and created an exploit that is actively employed against users of Internet Explorer and Mozilla Firefox running on any version of Windows.
The first two exploits are delivered through Angler, while the third one is flung by Hanjuan exploit kit, according to independent researcher Kafeine.
Security researchers from Cisco monitored the activity of Angler and noticed that with CVE-2015-0311 the campaign started on January 26, the most active days being January 28 and 29. Full Article
