BlackHole

Blackhole is an exploit kit that was widely used in the early 2010s to industrialize browser-based exploitation as a subscription-style crimeware service. The provided content associates it with Dmitry "Paunch" Fedotov, noting that he used the Blackhole exploit kit to spread multiple forms of malware internationally and that Blackhole was available alongside other criminal services such as the Psyche/Cutwail spambot. The content describes Blackhole as actively targeting known, already-patched client-side vulnerabilities rather than relying on zero-days, including a remote code execution flaw in Oracle Java shortly after Oracle had patched it. It is referenced as part of the exploit-kit era alongside Phoenix, Nuclear, and later Angler, and as an example of how vulnerability exploitation became packaged, updated, rented, and sold with tiered pricing. The content also notes that Blackhole was successfully targeting outdated browsers and plugins, especially Java, and that exploit kits like Blackhole contributed to large-scale compromise risk from unpatched browser components. One mention states that Blackhole and Metasploit Browser AutoPwn were detected and blocked by Microsoft Forefront during a penetration test, indicating its use as an automated browser exploitation framework. The content further states that the Blackhole exploit kit ecosystem largely collapsed after a takedown in 2013. No high-confidence IOCs beyond the malware name and association with browser/plugin exploitation are provided in the content.