Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

04:07 PM
Connect Directly

'Blackhole' Activity Dips Amid Reports Of Bust

Reports point to possible arrest of Blackhole crimeware author, but changing of the guard is already under way as other kits gain a foothold

The silence has been deafening out of Russia since the reported arrest of the author of the infamous Blackhole exploit kit -- no official announcement came of a bust akin to how botnet takedowns or indictments are typically trumpeted here in the U.S. Meanwhile, security researchers have noticed gaps in Blackhole activity during the past couple of days that appear to corroborate a disruption in the crimeware kit's operations.

Word got out yesterday via social media that "Paunch," the Russian malware writer behind the popular and user-friendly Blackhole exploit kit, had been apprehended in Russia. TechWeek Europe today reported that Troels Oerting, head of the European Cybercrime Centre, confirmed there had been an arrest, but he wouldn't elaborate.

Some security researchers say they've witnessed chatter about Paunch's arrest in underground forums, and one source who requested anonymity confirmed the arrest. Arrests of cybercriminals are still relatively rare, especially in Russia, where cybercrime organizations are known to operate relatively freely as long as they don't target their own citizens. So the prospect of the bust of a major player in cybercrime is big news: "This speaks volumes that this is now viewed as an international problem," says Will Gragido, senior manager of RSA First Watch. "I don't know where the arrest originated, but what I read within the forums was that it was orchestrated out of the Russian Federation. So that's pretty significant" if it proves to be true, he says.

Tom Kellermann, vice president of cybersecurity at Trend Micro, says the reported arrest bodes well for improved cooperation among global law enforcement agencies. "This indictment speaks volumes to the organization of the shadow economy," Kellermann says. "This unprecedented collaboration has been years in the making. Interpol and Europol have stepped up their game."

Among the signs that something's up: The service that encrypts the Blackhole exploit kit, crypt.am, had gone offline and remains so as of this post, and Sophos noticed a rare decline in Blackhole infection detections in its lab during the past 24 hours or so since word of an arrest broke. "We did see a decline in detections, which is abnormal," says Chester Wisniewski, senior security adviser at Sophos.

RSA's Gragido says the fact crypt.am is down is significant. "[Crypt.am] allows you to encrypt the Blackhole exploit kit," he says. "That it's not been updated in two or four days is pretty telling. It had been updated on a daily basis since the arrival of Blackhole on the open market."

Blackhole has been a mainstay in malware since it first emerged on the scene nearly two years ago. The crimeware kit serves up browser-based exploits via infected websites, with the ultimate goal of planting ransomware, financial data-stealing Trojans, or other malware on machines that visit the sites. "Blackhole gave virtually anyone the ability to become a botnet master. When you stop to think about it, it's pretty powerful and probably more ubiquitous than its competitors because it was easy to manipulate," Gragido says.

[Tales from the trenches show that even small organizations are in the bull's eye . See 5 Lessons From Real-World Attacks .]

So what does a bust mean for Blackhole? Customers who rent the kit won't get updates, so their exploits eventually will become "stale," says Jerome Segura, a senior security researcher at Malwarebytes, who today also confirmed that crypt.am was down.

The dip in threats may provide only a very temporary respite in kit-driven cybercrime attacks as Blackhole cybercriminal customers move their businesses to other crimeware kits. Like a botnet takedown, the decline will be short-lived; the bad guys will just retrench and re-emerge elsewhere. According to a French security researcher known as Kafeine, the Reveton ransomware gang was seen migrating away from another of Paunch's malware kits, Cool EK, to a Whitehole exploit kit.

"The interesting thing about this is if, in fact, [Paunch] was arrested, we are going to see a surge in the use of other kits in lieu" of Blackhole, Gragido says. Cool, Stix, and Poison Ivy are prime candidates, he says. And older tools like Liberty and Eleonore could re-emerge, he says.

Even so, Blackhole had lost some "market share" during the past few months to other kits. Sophos' Wisniewski says last year Blackhole made up about 70 percent of infections in websites -- No. 1 -- but today it's somewhere around the fourth or fifth most common infection of websites.

As of August, Blackhole and sister Cool made up only 4 percent of website infections, according to new data released today by Sophos, and had dropped to just 2 percent during the past seven days. Glazunov/Sibhost (48 percent) is now leading the pack by far, followed by Neutrino (35 percent), Stix (3 percent), Sweet Orange (3 percent), and Cool (2 percent). Whitehole is responsible for 1 percent of website infections.

Wisniewski says Blackhole has basically been a victim of its own success. "Any time we see successful criminal techniques, you see other criminals come in and improve on it," he says. "Blackhole was the first exploit-as-a-service ... people buying it loved it, and it was always up to date with the latest exploit. But you saw a lot of copycats."

Curt Wilson, ASERT research analyst with Arbor, says exploit kits are a key component in the cybercrime economy. Even with new crimeware kits taking center stage, there are ways to defend against them, including "robust" patching of applications-- especially major targets like Java and Adobe Acrobat and Reader -- and Microsoft's EMET tool, as well as network monitoring.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-01-27
CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.
PUBLISHED: 2020-01-27
A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpdate.exe (which is running as NT AUTHORITY\SYSTEM) when AvastSecureBrowser.exe checks for new updates. When the update check is triggered, the...
PUBLISHED: 2020-01-27
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.
PUBLISHED: 2020-01-27
The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module, related to unstripping special page HTML.
PUBLISHED: 2020-01-27
The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric ...