Blackhole Activity Dips Amid Reports Of Bust

Reports point to possible arrest of Blackhole crimeware author, but changing of the guard is already under way as other kits gain a foothold

The silence has been deafening out of Russia since the reported arrest of the author of the infamous Blackhole exploit kit -- no official announcement came of a bust akin to how botnet takedowns or indictments are typically trumpeted here in the U.S. Meanwhile, security researchers have noticed gaps in Blackhole activity during the past couple of days that appear to corroborate a disruption in the crimeware kits operations.
Word got out yesterday via social media that Paunch, the Russian malware writer behind the popular and user-friendly Blackhole exploit kit, had been apprehended in Russia. TechWeek Europe today
reported
that Troels Oerting, head of the European Cybercrime Centre, confirmed there had been an arrest, but he wouldnt elaborate.
Some security researchers say theyve witnessed chatter about Paunchs arrest in underground forums, and one source who requested anonymity confirmed the arrest. Arrests of cybercriminals are still relatively rare, especially in Russia, where cybercrime organizations are known to operate relatively freely as long as they dont target their own citizens. So the prospect of the bust of a major player in cybercrime is big news: This speaks volumes that this is now viewed as an international problem, says Will Gragido, senior manager of RSA First Watch. I dont know where the arrest originated, but what I read within the forums was that it was orchestrated out of the Russian Federation. So thats pretty significant if it proves to be true, he says.
Tom Kellermann, vice president of cybersecurity at Trend Micro, says the reported arrest bodes well for improved cooperation among global law enforcement agencies. This indictment speaks volumes to the organization of the shadow economy, Kellermann says. This unprecedented collaboration has been years in the making. Interpol and Europol have stepped up their game.
Among the signs that somethings up: The service that encrypts the Blackhole exploit kit, crypt.am, had gone offline and remains so as of this post, and Sophos noticed a rare decline in Blackhole infection detections in its lab during the past 24 hours or so since word of an arrest broke. We did see a decline in detections, which is abnormal, says Chester Wisniewski, senior security adviser at Sophos.
RSAs Gragido says the fact crypt.am is down is significant. [Crypt.am] allows you to encrypt the Blackhole exploit kit, he says. That its not been updated in two or four days is pretty telling. It had been updated on a daily basis since the arrival of Blackhole on the open market.
Blackhole has been a mainstay in malware since it first emerged on the scene nearly two years ago. The crimeware kit serves up browser-based exploits via infected websites, with the ultimate goal of planting ransomware, financial data-stealing Trojans, or other malware on machines that visit the sites. Blackhole gave virtually anyone the ability to become a botnet master. When you stop to think about it, its pretty powerful and probably more ubiquitous than its competitors because it was easy to manipulate, Gragido says.
[Tales from the trenches show that even small organizations are in the bulls eye . See
5 Lessons From Real-World Attacks
.]
So what does a bust mean for Blackhole? Customers who rent the kit wont get updates, so their exploits eventually will become stale, says Jerome Segura, a senior security researcher at Malwarebytes, who today
also confirmed
that crypt.am was down.
The dip in threats may provide only a very temporary respite in kit-driven cybercrime attacks as Blackhole cybercriminal customers move their businesses to other crimeware kits. Like a botnet takedown, the decline will be short-lived; the bad guys will just retrench and re-emerge elsewhere. According to a French security researcher known as
Kafeine
, the Reveton ransomware gang was seen migrating away from another of Paunchs malware kits, Cool EK, to a Whitehole exploit kit.
The interesting thing about this is if, in fact, [Paunch] was arrested, we are going to see a surge in the use of other kits in lieu of Blackhole, Gragido says. Cool, Stix, and Poison Ivy are prime candidates, he says. And older tools like Liberty and Eleonore could re-emerge, he says.
Even so, Blackhole had lost some market share during the past few months to other kits. Sophos Wisniewski says last year Blackhole made up about 70 percent of infections in websites -- No. 1 -- but today its somewhere around the fourth or fifth most common infection of websites.
As of August, Blackhole and sister Cool made up only 4 percent of website infections, according to
new data released today by Sophos
, and had dropped to just 2 percent during the past seven days. Glazunov/Sibhost (48 percent) is now leading the pack by far, followed by Neutrino (35 percent), Stix (3 percent), Sweet Orange (3 percent), and Cool (2 percent). Whitehole is responsible for 1 percent of website infections.
Wisniewski says Blackhole has basically been a victim of its own success. Any time we see successful criminal techniques, you see other criminals come in and improve on it, he says. Blackhole was the first exploit-as-a-service ... people buying it loved it, and it was always up to date with the latest exploit. But you saw a lot of copycats.
Curt Wilson, ASERT research analyst with Arbor, says exploit kits are a key component in the cybercrime economy. Even with new crimeware kits taking center stage, there are ways to defend against them, including robust patching of applications-- especially major targets like Java and Adobe Acrobat and Reader -- and Microsofts EMET tool, as well as network monitoring.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Blackhole Activity Dips Amid Reports Of Bust