BlackHole Exploit Kit Operator Paunch Arrested After Group-IB Investigation
Summary
Group-IB investigators helped identify Paunch, operator of the BlackHole and Cool exploit kits, leading to his 2013 arrest and the prosecution of associates. The takedown halted the kits’ operations, which had been used to deliver malware.
Key points
- Paunch operated the BlackHole and Cool exploit kits, which cybercriminals used to exploit browser vulnerabilities and deliver malware.
- The kits were distributed through compromised websites and spam; BlackHole was also used to deliver banking malware, downloaders, and other trojans.
- Group-IB investigators traced the kits’ infrastructure and analyzed underground forum activity to identify Paunch and his network.
- Paunch was arrested in October 2013 alongside other members of the criminal group; the article says 12 associates were also charged.
- The investigation led to the operations being halted, removing a tool used by threat actors to infect victims.
- The article estimates the group caused $2.3 million in damage and says the kits accounted for about 40% of the exploit-kit market.
Article Details
- Event Type
- Law-enforcement investigation and prosecution of Paunch and associates for developing, selling, and profiting from exploit kits and related cybercrime services.
- Impact
- Paunch was arrested on 2013-10-04, and the article says the investigation permanently halted operations involving the BlackHole and Cool Exploit Kits. Twelve other members of the criminal group were also charged. The group’s damage was estimated at USD 2.3 million; the article attributes about 40% of infections detected worldwide to Paunch’s tools.
Threat Actors
ADVNamed as one of Paunch’s partners or major clients who was arrested.GermesNamed as one of Paunch’s partners or major clients who was arrested.J.P.MORGANDescribed as a fraudster and Paunch ally who helped acquire exploits and promoted the exploit kits.PaunchCybercriminal and developer and seller of the BlackHole and Cool Exploit Kits; arrested in 2013.PioneerNamed as one of Paunch’s partners or major clients who was arrested.VellesNamed as one of Paunch’s partners or major clients who was arrested.
Vendors
Products
BlackHoleThe name behind two such exploit kits—BlackHole and Cool Exploit Kits—was Paunch.Cool Exploit Kitsuccess. These efforts funded a pricier ($10,000/month) and more exclusive exploit pack called the “Cool Exploit Kit.” This new exploit kit aimed to improve the quality of exploiting vulnerabilities, therebyCool Exploit KitsThe name behind two such exploit kits—BlackHole and Cool Exploit Kits—was Paunch.Crypt.amHe also specialized in supporting the online service Crypt.am, which automatically obfuscated malware source codes. In other words, Crypt.am protects malware from detection by antivirus programs. The unlimited tariff