The Sundown Exploit Kit that first came to light in mid 2016, appears to be under aggressive development. The exploit-kit is actively attacking the Edge Browser from Microsoft shipped with Windows 10. Specifically, the exploit-kit is targeting CVE-2016-7200 and CVE-2016-7201 which Microsoft fixed with update MS16-129, released on Patch Tuesday in the month of November.
The vulnerability is a Info Leak + Type confusion vulnerability in the Chakra JavaScript engine developed by Microsoft. Interestingly, a proof-of-concept of these vulnerabilities was posted by theori.io on github last week. Sundown EK was quite aggressive and incorporated this in the exploit kit in around 24 hours.
Qualys identifies this vulnerability with QID: 91300 – Microsoft Edge Cumulative Security Update (MS16-129) and recommends customer patch their systems with highest priority.
