'Blackhole' Activity Dips Amid Reports Of Bust

The silence has been deafening out of Russia since the reported arrest of the author of the infamous Blackhole exploit kit -- no official announcement came of a bust akin to how botnet takedowns or indictments are typically trumpeted here in the U.S. Meanwhile, security researchers have noticed gaps in Blackhole activity during the past couple of days that appear to corroborate a disruption in the crimeware kit's operations.

Word got out yesterday via social media that "Paunch," the Russian malware writer behind the popular and user-friendly Blackhole exploit kit, had been apprehended in Russia. TechWeek Europe today reported that Troels Oerting, head of the European Cybercrime Centre, confirmed there had been an arrest, but he wouldn't elaborate.

Some security researchers say they've witnessed chatter about Paunch's arrest in underground forums, and one source who requested anonymity confirmed the arrest. Arrests of cybercriminals are still relatively rare, especially in Russia, where cybercrime organizations are known to operate relatively freely as long as they don't target their own citizens. So the prospect of the bust of a major player in cybercrime is big news: "This speaks volumes that this is now viewed as an international problem," says Will Gragido, senior manager of RSA First Watch. "I don't know where the arrest originated, but what I read within the forums was that it was orchestrated out of the Russian Federation. So that's pretty significant" if it proves to be true, he says.

Tom Kellermann, vice president of cybersecurity at Trend Micro, says the reported arrest bodes well for improved cooperation among global law enforcement agencies. "This indictment speaks volumes to the organization of the shadow economy," Kellermann says. "This unprecedented collaboration has been years in the making. Interpol and Europol have stepped up their game."

Among the signs that something's up: The service that encrypts the Blackhole exploit kit, crypt.am, had gone offline and remains so as of this post, and Sophos noticed a rare decline in Blackhole infection detections in its lab during the past 24 hours or so since word of an arrest broke. "We did see a decline in detections, which is abnormal," says Chester Wisniewski, senior security adviser at Sophos.

RSA's Gragido says the fact crypt.am is down is significant. "[Crypt.am] allows you to encrypt the Blackhole exploit kit," he says. "That it's not been updated in two or four days is pretty telling. It had been updated on a daily basis since the arrival of Blackhole on the open market."

Blackhole has been a mainstay in malware since it first emerged on the scene nearly two years ago. The crimeware kit serves up browser-based exploits via infected websites, with the ultimate goal of planting ransomware, financial data-stealing Trojans, or other malware on machines that visit the sites. "Blackhole gave virtually anyone the ability to become a botnet master. When you stop to think about it, it's pretty powerful and probably more ubiquitous than its competitors because it was easy to manipulate," Gragido says.

[Tales from the trenches show that even small organizations are in the bull's eye . See 5 Lessons From Real-World Attacks .]

So what does a bust mean for Blackhole? Customers who rent the kit won't get updates, so their exploits eventually will become "stale," says Jerome Segura, a senior security researcher at Malwarebytes, who today also confirmed that crypt.am was down.

The dip in threats may provide only a very temporary respite in kit-driven cybercrime attacks as Blackhole cybercriminal customers move their businesses to other crimeware kits. Like a botnet takedown, the decline will be short-lived; the bad guys will just retrench and re-emerge elsewhere. According to a French security researcher known as Kafeine, the Reveton ransomware gang was seen migrating away from another of Paunch's malware kits, Cool EK, to a Whitehole exploit kit.

"The interesting thing about this is if, in fact, [Paunch] was arrested, we are going to see a surge in the use of other kits in lieu" of Blackhole, Gragido says. Cool, Stix, and Poison Ivy are prime candidates, he says. And older tools like Liberty and Eleonore could re-emerge, he says.

Even so, Blackhole had lost some "market share" during the past few months to other kits. Sophos' Wisniewski says last year Blackhole made up about 70 percent of infections in websites -- No. 1 -- but today it's somewhere around the fourth or fifth most common infection of websites.

As of August, Blackhole and sister Cool made up only 4 percent of website infections, according to new data released today by Sophos, and had dropped to just 2 percent during the past seven days. Glazunov/Sibhost (48 percent) is now leading the pack by far, followed by Neutrino (35 percent), Stix (3 percent), Sweet Orange (3 percent), and Cool (2 percent). Whitehole is responsible for 1 percent of website infections.

Wisniewski says Blackhole has basically been a victim of its own success. "Any time we see successful criminal techniques, you see other criminals come in and improve on it," he says. "Blackhole was the first exploit-as-a-service ... people buying it loved it, and it was always up to date with the latest exploit. But you saw a lot of copycats."

Curt Wilson, ASERT research analyst with Arbor, says exploit kits are a key component in the cybercrime economy. Even with new crimeware kits taking center stage, there are ways to defend against them, including "robust" patching of applications-- especially major targets like Java and Adobe Acrobat and Reader -- and Microsoft's EMET tool, as well as network monitoring.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.