RIG Surpasses Neutrino to Become Today's Most Active Exploit Kit

The exploit kit landscape is changing and according to multiple sources, activity from the Neutrino exploit kit service si waning, with the RIG crew moving in to take its place.

The latest security firm to add its voice to this conclusion is Malwarebytes, after previous reports from Heimdal Security, who spotted an increase in RIG activity, and Cisco Talos, who helped bring down a massive malvertising campaign that used the Neutrino exploit kit, leaving a huge gap for RIG to fill.

"Following the demise of the Angler exploit kit in June, Neutrino EK assumed the lead position by having the top malware and malvertising campaigns defaulted to it," Jerome Segura of

SecRule REQUEST_URI "@rx ..." "id:1001,phase:1,deny,status:403"

find /var/www -type f -name "*.php" -mmin -120

ss -tunp | grep -E ":(4444|1337|8080|9001)"

apt update && apt --only-upgrade install <pkg>

title: Detect Exploitation - RIG Surpasses Neutrino to Become Today's Most Active Exploit Kit
id: df060ebc-e96d-48c6-a7bc-e9be74db6f5e
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "RIG Surpasses Neutrino to Beco" ascii wide
    condition:
        any of them
}