The Blackhole exploit kit has reappeared in the wild surprising the security industry after that in October 2013 its author, know as Paunch, was arrested. Paunch was the author of two of the most popular exploit kits, Blackhole and the Cool Exploit Kit, that dominated the underground scene in recent years.
The Blackhole exploit kit was widely used to hack into several Web browsers and exploit flaws in popular software such as Adobe Reader. The winning factors for the success of Blackhole exploit kit were its efficiency, the availability of various models for sale (e.g. I was available for sale and rent in the underground market), availability of frequent updates and an affordable price (Blackhole was offered for rent as little as $200 to $300 per week).
The experts at Malwarebytes have noticed that threat actors in the wild are reusing the exploits despite their limited effectiveness. Malwarebytes observed the new variant of the BlackHole Exploit kit includes old PDF and Java exploits.
“The new drive-by download attacks we caught over the weekend rely on the same structure as the original Blackhole, even reusing the old PDF and Java exploits. The only difference is the malware payload being dropped, which is current and had very low detection on VirusTotal.” reports MalwareBytes.
The source code of the Blackhole was leaked online four years ago allowing cybercriminals to reuse it and add new features to the core modules. The numerous hacking communities could offer their variant of the Blackhole exploit kit that implements fresh exploits for vulnerabilities recently discovered.
Fortunately, the researchers at Malwarebytes have discovered that threat actors behind the new Blackhole campaign left the server that hosted the control infrastructure open on the Internet, a circumstance that allowed the expert to access it.
The intent of the attacker is to try to compromise the numerous computer still vulnerable on the Internet, but the experts highlight the infection rate would be quite low due to the aging exploits
“Although the exploits are old, there are probably still vulnerable computers out there who could get compromised,” Segura wrote. “We are not quite sure why this old exploit kit is being used in live attacks considering the infection rate would be quite low due to the aging exploits.” said Jerome Segura, a senior security researcher for Malwarebytes.
MalwareBytes also published the Indicators of compromise on its website.
(Security Affairs –Blackhole Exploit Kit, malware)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.