New exploit kit may be "cooler" than BlackHole

Share this article:

Researchers believe a new exploit kit on the market is a pricier version of BlackHole, packaged with enough zero-day threats and other features to take the top spot from its predecessor.

The “Cool" exploit kit, thought to be created by the same group behind BlackHole, which is led by a Russian hacker with the online alias “Paunch,” first appeared on the underground market in October.

On Monday, security journalist Brian Krebs confirmed that Paunch acknowledged responsibility for the Cool exploit kit on a semi-private cyber crime forum. Exploit kits are sold on the black market as a means of easily serving malware from compromised sites. The kits often deliver exploits for vulnerabilities, both of the publicly known and unknown variety, in widely deployed software, such as Java or Adobe.

“Our team prepared the following exclusive program of purchasing new browser and browser plug-in vulnerabilities,” read the forum message, which Krebs reposted on his blog. “Not only do we buy exploits and vulnerabilities, but also improvements to existing public exploits, and also any good solutions for improving the rate of exploitation.”

It's believed that Cool's hefty price tag – $10,000 a month, compared to the BlackHole kit's substantially lower cost of around $500 a month – covers the cyber crime group's $100,000 investment in zero-days for clients. 

“We are setting aside a $100K budget to purchase browser and browser plug-in vulnerabilities, which are going to be used exclusively by us, without being released to public (not counting the situations, when a vulnerability is made public not because of us),” said the forum post.

In a Thursday interview with, Jeff Doty, web security data analyst for Blue Coat, a Sunnyvale, Calif.-based web security company, said that in the last few years, other exploit kits have tried to replace BlackHole's influence in the market, but none have grown at the pace as the Cool exploit kit.

“In the last couple of years, there have been a lot of exploit kits, but we block the IP addresses and we usually don't see too much from them after that,” Doty said. “They don't grow as much as this Cool exploit kit. They also don't seem to be coded as well.”

Blue Coat researchers discovered that during last month alone, 204 new servers were hosting compromised web pages that delivered the Cool exploit kit to visitors. In the same month, Blue Coat detected only 32 new servers hosting malicious pages serving up BlackHole.  

Share this article:

Sign up to our newsletters

More in News

Russian hacker Seleznev ordered to remain in custody

Roman Seleznev's attorneys requested that the hacker be released on bond, but their pleas were rejected this past week.

Bug in iOS Instagram app fixed, impacts Facebook accounts

The vulnerability comes into play when Instagram users search for Facebook friends to "follow."

AP denied security docs on, a risk to private information

AP denied security docs on, a risk ...

The Associated Press was denied a request made under the Freedom of Information Act for documents that contain security information on