New exploit kit may be "cooler" than BlackHole

Share this article:

Researchers believe a new exploit kit on the market is a pricier version of BlackHole, packaged with enough zero-day threats and other features to take the top spot from its predecessor.

The “Cool" exploit kit, thought to be created by the same group behind BlackHole, which is led by a Russian hacker with the online alias “Paunch,” first appeared on the underground market in October.

On Monday, security journalist Brian Krebs confirmed that Paunch acknowledged responsibility for the Cool exploit kit on a semi-private cyber crime forum. Exploit kits are sold on the black market as a means of easily serving malware from compromised sites. The kits often deliver exploits for vulnerabilities, both of the publicly known and unknown variety, in widely deployed software, such as Java or Adobe.

“Our team prepared the following exclusive program of purchasing new browser and browser plug-in vulnerabilities,” read the forum message, which Krebs reposted on his blog. “Not only do we buy exploits and vulnerabilities, but also improvements to existing public exploits, and also any good solutions for improving the rate of exploitation.”

It's believed that Cool's hefty price tag – $10,000 a month, compared to the BlackHole kit's substantially lower cost of around $500 a month – covers the cyber crime group's $100,000 investment in zero-days for clients. 

“We are setting aside a $100K budget to purchase browser and browser plug-in vulnerabilities, which are going to be used exclusively by us, without being released to public (not counting the situations, when a vulnerability is made public not because of us),” said the forum post.

In a Thursday interview with, Jeff Doty, web security data analyst for Blue Coat, a Sunnyvale, Calif.-based web security company, said that in the last few years, other exploit kits have tried to replace BlackHole's influence in the market, but none have grown at the pace as the Cool exploit kit.

“In the last couple of years, there have been a lot of exploit kits, but we block the IP addresses and we usually don't see too much from them after that,” Doty said. “They don't grow as much as this Cool exploit kit. They also don't seem to be coded as well.”

Blue Coat researchers discovered that during last month alone, 204 new servers were hosting compromised web pages that delivered the Cool exploit kit to visitors. In the same month, Blue Coat detected only 32 new servers hosting malicious pages serving up BlackHole.  

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters


More in News

Email promises free pizza, ensnares victims in Asprox botnet instead

Email promises free pizza, ensnares victims in Asprox ...

Cloudmark came upon an email that offers free pizza, but clicking on the link to get the coupon ends with victims being ensnared in a botnet.

Report: most orgs lacking in response team, policies to address cyber incidents

In its Q3 threat intelligence report, Solutionary learned that 75 percent of organizations it assisted had no response team or policies and procedures to address cyber incidents.

Flash redirect campaign impacts Carnegie Mellon page, leads to Angler EK

Flash redirect campaign impacts Carnegie Mellon page, leads ...

Malwarebytes found that, since early July, thousands of sites had been targeted in the campaign.