Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

04:07 PM
Connect Directly

'Blackhole' Activity Dips Amid Reports Of Bust

Reports point to possible arrest of Blackhole crimeware author, but changing of the guard is already under way as other kits gain a foothold

The silence has been deafening out of Russia since the reported arrest of the author of the infamous Blackhole exploit kit -- no official announcement came of a bust akin to how botnet takedowns or indictments are typically trumpeted here in the U.S. Meanwhile, security researchers have noticed gaps in Blackhole activity during the past couple of days that appear to corroborate a disruption in the crimeware kit's operations.

Word got out yesterday via social media that "Paunch," the Russian malware writer behind the popular and user-friendly Blackhole exploit kit, had been apprehended in Russia. TechWeek Europe today reported that Troels Oerting, head of the European Cybercrime Centre, confirmed there had been an arrest, but he wouldn't elaborate.

Some security researchers say they've witnessed chatter about Paunch's arrest in underground forums, and one source who requested anonymity confirmed the arrest. Arrests of cybercriminals are still relatively rare, especially in Russia, where cybercrime organizations are known to operate relatively freely as long as they don't target their own citizens. So the prospect of the bust of a major player in cybercrime is big news: "This speaks volumes that this is now viewed as an international problem," says Will Gragido, senior manager of RSA First Watch. "I don't know where the arrest originated, but what I read within the forums was that it was orchestrated out of the Russian Federation. So that's pretty significant" if it proves to be true, he says.

Tom Kellermann, vice president of cybersecurity at Trend Micro, says the reported arrest bodes well for improved cooperation among global law enforcement agencies. "This indictment speaks volumes to the organization of the shadow economy," Kellermann says. "This unprecedented collaboration has been years in the making. Interpol and Europol have stepped up their game."

Among the signs that something's up: The service that encrypts the Blackhole exploit kit, crypt.am, had gone offline and remains so as of this post, and Sophos noticed a rare decline in Blackhole infection detections in its lab during the past 24 hours or so since word of an arrest broke. "We did see a decline in detections, which is abnormal," says Chester Wisniewski, senior security adviser at Sophos.

RSA's Gragido says the fact crypt.am is down is significant. "[Crypt.am] allows you to encrypt the Blackhole exploit kit," he says. "That it's not been updated in two or four days is pretty telling. It had been updated on a daily basis since the arrival of Blackhole on the open market."

Blackhole has been a mainstay in malware since it first emerged on the scene nearly two years ago. The crimeware kit serves up browser-based exploits via infected websites, with the ultimate goal of planting ransomware, financial data-stealing Trojans, or other malware on machines that visit the sites. "Blackhole gave virtually anyone the ability to become a botnet master. When you stop to think about it, it's pretty powerful and probably more ubiquitous than its competitors because it was easy to manipulate," Gragido says.

[Tales from the trenches show that even small organizations are in the bull's eye . See 5 Lessons From Real-World Attacks .]

So what does a bust mean for Blackhole? Customers who rent the kit won't get updates, so their exploits eventually will become "stale," says Jerome Segura, a senior security researcher at Malwarebytes, who today also confirmed that crypt.am was down.

The dip in threats may provide only a very temporary respite in kit-driven cybercrime attacks as Blackhole cybercriminal customers move their businesses to other crimeware kits. Like a botnet takedown, the decline will be short-lived; the bad guys will just retrench and re-emerge elsewhere. According to a French security researcher known as Kafeine, the Reveton ransomware gang was seen migrating away from another of Paunch's malware kits, Cool EK, to a Whitehole exploit kit.

"The interesting thing about this is if, in fact, [Paunch] was arrested, we are going to see a surge in the use of other kits in lieu" of Blackhole, Gragido says. Cool, Stix, and Poison Ivy are prime candidates, he says. And older tools like Liberty and Eleonore could re-emerge, he says.

Even so, Blackhole had lost some "market share" during the past few months to other kits. Sophos' Wisniewski says last year Blackhole made up about 70 percent of infections in websites -- No. 1 -- but today it's somewhere around the fourth or fifth most common infection of websites.

As of August, Blackhole and sister Cool made up only 4 percent of website infections, according to new data released today by Sophos, and had dropped to just 2 percent during the past seven days. Glazunov/Sibhost (48 percent) is now leading the pack by far, followed by Neutrino (35 percent), Stix (3 percent), Sweet Orange (3 percent), and Cool (2 percent). Whitehole is responsible for 1 percent of website infections.

Wisniewski says Blackhole has basically been a victim of its own success. "Any time we see successful criminal techniques, you see other criminals come in and improve on it," he says. "Blackhole was the first exploit-as-a-service ... people buying it loved it, and it was always up to date with the latest exploit. But you saw a lot of copycats."

Curt Wilson, ASERT research analyst with Arbor, says exploit kits are a key component in the cybercrime economy. Even with new crimeware kits taking center stage, there are ways to defend against them, including "robust" patching of applications-- especially major targets like Java and Adobe Acrobat and Reader -- and Microsoft's EMET tool, as well as network monitoring.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio


Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-08-11
By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5
PUBLISHED: 2020-08-11
Broker Protocol messages in Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows prior to 20.04.1 are not cleaned up in server memory, which may allow an attacker to read confidential information from a memory dump via forcing a crashing during the single sign-on procedure.
PUBLISHED: 2020-08-11
An improperly initialized 'migrationAuth' value in Google's go-tpm TPM1.2 library versions prior to 0.3.0 can lead an eavesdropping attacker to discover the auth value for a key created with CreateWrapKey. An attacker listening in on the channel can collect both 'encUsageAuth' and 'encMigrationAuth'...
PUBLISHED: 2020-08-11
HUAWEI Mate 20 versions Versions earlier than;HUAWEI Mate 20 Pro versions Versions earlier than,Versions earlier than,Versions earlier than;HUAWEI Mate 20 X versions Versions earlier than
PUBLISHED: 2020-08-11
In PACTware before 4.1 SP6 and 5.x before, passwords are stored in a recoverable format, and may be retrieved by any user with access to the PACTware workstation.