BlackHole

Blackhole Exploit Kit was a widely used crimeware exploit kit active primarily in the early 2010s that industrialized browser-based compromise as a subscription service. It was operated and rented within the cybercriminal underground and became one of the most prominent exploit kits of its era, commonly associated with Dmitry “Paunch” Fedotov. Blackhole was used to compromise visiting systems through malicious or hacked websites and redirector chains, where it profiled browsers and plugins and attempted exploitation of known client-side vulnerabilities, especially in Java, Adobe Flash, Adobe Reader, Microsoft Internet Explorer, and Windows components. Successful exploitation typically resulted in delivery of follow-on malware rather than long-term resident functionality from the kit itself.

Blackhole served as a major distribution mechanism for a broad range of malware families, including banking trojans, ransomware, infostealers, and other payloads such as Cridex, Sinowal, Reveton, Citadel-associated infections, Sefnit-related components, and other commodity crimeware. It was frequently embedded in hacked web infrastructure and was also reached through malicious links in phishing campaigns or traffic redirection from compromised servers and web backdoors such as Linux/Cdorked. Observed campaigns used Blackhole to exploit victims opportunistically at scale, often relying on outdated software rather than zero-day vulnerabilities.

The kit is notable for helping commercialize exploit delivery with packaged updates, versioned releases, and operational panels that tracked infection success. Its prominence made it a central component of the exploit-kit ecosystem until its disruption and collapse in 2013, after which other kits filled the gap it left in the cybercrime market.