Comment by daenz

> Careful to protect their exploits, the attackers deployed multiple safeguards to make it difficult for security teams to recover any of the stages. These safeguards included:

  * Only serving the iframe at specific times, presumably when they knew an intended target would be visiting the site.
  * In some email campaigns the targets received links with unique IDs. This was potentially used to enforcea one-time-click policy for each link and allow the exploit kit to only be served once.
  * The exploit kit would AES encrypt each stage, including the clients’ responses with a session-specific key.
  * Additional stages were not served if the previous stage failed.

Is this a normal level of sophistication for a CVE?