21. IP Tracking and Web Kits

• Attackers keep track of IPs they have compromised

• MPack and IcePack are the two most popular kits:

  • provide the user with a Web interface, and

  • configuration options to set up a downloader

• The downloader is

  • the program that runs on exploited machines after an attack has succeeded,

  • fetches and executes malware from wherever it's configured to do so, and

  • can use encryption to avoid networkbased detection.