Angler

Angler Exploit Kit was one of the most prominent crimeware exploit kits of the mid-2010s, used to automate browser-based compromise at scale. It profiled visiting systems and attempted to exploit vulnerabilities in browsers and common client-side components, especially Internet Explorer and Adobe Flash, to execute code and deliver follow-on malware. Angler was notable for industrializing exploit delivery, including encrypted exploit traffic and highly evasive infection chains, and it was frequently associated with fileless execution techniques that loaded payloads directly into memory rather than relying on conventional dropped executables.

The kit was widely distributed through malvertising and compromised or shadowed web infrastructure, with victims redirected from malicious advertisements or intermediary sites to Angler landing pages. It was also referenced as a common exploit-kit component in broader web-based intrusion chains. Angler operators used filtering and anti-analysis logic to improve success rates and reduce exposure to researchers and security tooling.

Angler served a range of criminal payloads. Ransomware was a major payload category, and Bedep was another significant payload closely associated with the kit. Bedep functioned as a downloader and was observed as an exclusive Angler payload in some reporting, with subsequent delivery of additional malware families including banking and credential-theft malware. Angler activity was also linked to fileless malware deployment and in-memory infection workflows.

The exploit kit has been linked in public reporting to Maksim Silnikau, and it was described as a widely used malware-deployment platform before being disrupted in 2016. Its significance lies in how it commercialized and scaled browser exploitation, helping define the exploit-kit era of cybercrime.