In order to keep spam levels consistent new nodes must be added constantly.
When RIG stopped distributing Tofsee payloads, those responsible for Tofsee switched to alternative distribution methods.
Each email contains slightly different text, however the same format is used across all of the messages Talos analyzed.
The messages purport to contain an attached zip archive with pictures of the sender as well as links to a Russian adult dating website.
This activity seemed to disappear in June, however Talos has recently observed a marked increase in the volume and velocity of spam email campaigns containing malicious attachments that are being used to distribute Tofsee.
In June 2016, following the disappearance of the Angler exploit kit from the threat landscape, other major exploit kits began to shift to different payloads.
If two clients like the scent of each other, boom — they’re a match.
The idea is based around the science of pheromones; the chemical signals that animals give off to entice mates.
I mean one day I can deal with, two days is pushing it, but three days?
You’ve pretty much given up on trying to be a normal human being if you don’t shower for three days.
The RIG exploit kit moved from distributing Tofsee to other payloads, possibly because distributing them was more attractive to cybercriminals from a monetization standpoint or simply because different actors began using this exploit kit as a distribution mechanism for their malware.