openPR Logo
Press release

‘Exploit Kits are the Latest Weapons of Cyber Destruction’, Warns Security Expert

02-05-2013 03:01 PM CET | IT, New Media & Software

Press release from: Blue Coat Systems

Cool EK vs BlackHole

Cool EK vs BlackHole

DUBAI, United Arab Emirates, 4 February, 2013: Malware is a business; people make their living writing and distributing it. Exploit kits are an effective and streamlined methodology of distributing malware; they allow the ‘Bad Guys’ to distribute payloads at a higher level than we have seen in the past. For this reason we've seen exploit kits grow in popularity over the last few years.

Chris Larsen, Malware Research Team Leader at Blue Coat gives his insight into the dark side of exploit kits:

Exploit kits are a cheap and effective platform to distribute malware to thousands of computers a day. In simple terms, exploit kits are prepackaged web application software, designed to exploit visitors' computers with an array of attacks. If vulnerability is found on the visiting computer, any desired payload can be installed. These payloads can be any flavor of malware: from fake AVs and ransomware, to banking Trojans, and anything in-between. For a sometimes hefty price, one may obtain a subscription to one of these kits, host it on a webserver, and watch as innocent visitors are exploited and infected with malware.

For the last few years, the “king” of exploit kits has been the Blackhole Exploit Kit (BHEK), created by a group led by “Paunch” in Russia. This kit has been a leader in the industry for a long time, but with the rapid growth of the malware industry, several other exploit kits are competing for Blackhole’s customers.

Two of these are the "Sweet Orange" kit and the Cool Exploit Kit that Blue Coat has been tracking for the last few months.

Forbidden Fruit
Sweet Orange comes to the market with many of the key features we have seen in other exploit kits: a database backend that records successful infections, statistics about exploits for Java, PDF, IE and Firefox, and of course regular updates. It does add a few unique selling points: a small footprint, a higher infection rate, and the claim that they will drive 150,000 unique visitors to your site daily.

Let’s say that I want to create a botnet with a piece of malware that I write. Sweet Orange claims to get a successful infection rate of 10% to 25% of the visitors who land on the malicious webpage. If we go with the lower percentage, and I get my promised 150,000 unique visitors a day, that gives me around 10,000 infections a day. That’s 10,000 new computers a day that will be joining my botnet. And it's all completely automated.

Cool Kit – Don’t let the name fool you
Cool kit is very similar to other exploit kits, but particularly similar to BHEK. This has led to speculation that Cool was developed by the same group. Brian Krebs confirmed that Cool does indeed come from Paunch and his group - his research led to posts on underground hacker forums where Paunch takes credit for Cool and gives some details on the project.

So what makes Cool different from BHEK and other exploit kits? For one, the Cool kit comes with a price tag of $10,000 a month. That is significantly higher than BHEK and other exploit kits, that can run anywhere from $500 - $1,500 a month. The reason for the price hike apparently comes from a $100,000 investment into new exploits the developers announced, that will be used exclusively by Cool and not made public. This could give Cool a significant leg-up on the competition with other exploit kits.

Recently, I have seen a sharp increase in the amount of servers that are hosting the Cool kit. I wanted to do a comparison to see how the Cool traffic compares to the traffic we are seeing from Blackhole, so I went back and looked at the number of new servers my Blue Coat team submitted to Blue Coat's Malnet Tracker each month:

As you can see in the graph above, Cool began steadily gaining ground on Blackhole when it was released. Then in December, the number of new IP addresses skyrocketed -- Cool outgrew BHEK by 6 to 1.

Tracking Icebergs – Blue Coat’s WebPulse to the Rescue
So what do you do when there's a new exploit kit wreaking havoc? You investigate it.

There are some great resources to learn about Sweet Orange, and some will even tell you domains and IP addresses that are hosting it. One such resource is the Malware Domain List.
As of now, has seven IP addresses, and eight domains, that are known to be hosting Sweet Orange. That seems like a small number to be driving 150,000 unique visitors to your malware site a day.

So that's a good start, but it doesn't let us see the whole picture -- only the tip of the iceberg.
Thanks to WebPulse, and the amount of traffic that comes through each day, Blue Coat can see a lot more of the iceberg. In my research, I found 45 different IP addresses (and a total of 267 different domains) that are dedicated to Sweet Orange. This sounds a lot more in line with the claim of 150,000 unique daily visitors.

I wondered if anyone else was seeing these. To find out, I took a sample of 20 domains and 20 IP addresses (that were completely dedicated to Sweet Orange) and ran them through a couple of different public virus scanners.

Only 7 of the 20 domains were caught by any of the vendors on Virustotal: three by one vendor, and four by another, or an average of 0.35 hits per domain. It got worse when I checked the IP addresses. There were zero hits on any of the 20.

I did the same test on with the 20 domains. The tools there did a little better, averaging 1.25 hits for each domain. This is definitely an improvement, but it is still only the tip of the iceberg.

If that weren't enough to worry about, malicious sites move a lot faster than icebergs, changing IP address and domains to avoid detection. Blue Coat’s WebPulse’s malnet tracker can follow the malicious hosts wherever they go, protecting customers along the way - we don't want them to be part of the "150,000".

About Blue Coat Systems
Blue Coat Systems provides Web security and WAN optimization solutions to 86 percent of FORTUNE Global 500 companies. As the market share leader in the secure web gateway market, Blue Coat sets the standard for enterprise security. Its solutions provide the visibility, protection and control required to optimize and secure the flow of information to any user, on any network, anywhere. For additional information, please visit

Blue Coat, ProxySG, WebPulse and the Blue Coat logo are registered trademarks or trademarks of Blue Coat Systems, Inc. and/or its affiliates in the United States and certain other countries. All other trademarks mentioned in this document are the property of their respective owners.

For more information, please contact:

Manal Abi Rafeh
Blue Coat Systems ME
Telephone: +971 4  3911620
Fax: +971 4 3911635
Email: manal.abirafeh@Blue

Media Contact:
Colin Saldanha
PR Consultant
Villa 41, 81-d Street, Uptown Mirdif
P.O. Box 78835, Dubai
United Arab Emirates

This release was published on openPR.

Permanent link to this press release:

Please set a link in the press area of your homepage to this press release on openPR. openPR disclaims liability for any content contained in this release.

You can edit or delete your press release ‘Exploit Kits are the Latest Weapons of Cyber Destruction’, Warns Security Expert here

News-ID: 250938 • Views:

More Releases from Blue Coat Systems

Blue Coat Appoints Chris Moore as Head of Middle East Sales Team
Blue Coat Appoints Chris Moore as Head of Middle East Sales Team
Dubai, United Arab Emirates, 20th February 2013 – Blue Coat Systems, Inc. a market and technology leader of Web security and WAN optimisation solutions, today announced the appointment of Chris Moore as the Regional Sales Director for its operations in the Middle East. The appointment comes at a time when Blue Coat is poised to expand its presence in the region. Reporting directly to the Vice President of EMEA Sales, Stuart
Borusan Holdings in Egypt Enhances Web Access Control and Security with Blue Coat ProxySG 900 Appliances
Borusan Holdings in Egypt Enhances Web Access Control and Security with Blue Coa …
DUBAI, United Arab Emirates, 18th February, 2013 – Blue Coat Systems, Inc., a market leader in Web security and WAN optimization, has announced the successful installation of the Blue Coat ProxySG 900 appliance for Turkish conglomerate, Borusan Holdings. The Group's employees are now protected by Blue Coat's market leading secure web gateway appliance, which delivers visibility, control and security of internet activity with the addition benefit of vastly improved bandwidth

More Releases for Cool

SC Cool Mist humidifier Review; The Complete Sleep Connection Cool Mist Humidifi …
During cold winter months (or in the heat of the summer when your AC is on), you may notice that the air in your home is dry. Just like very humid air could be bad news for your health, dry air may cause nose and eye irritation in otherwise healthy people. One solution is to use a SC cool mist humidifier if the air in your home is too dry.
A Comprehensive Study exploring Cool Chain Market
HTF MI recently broadcasted a new study in its database that highlights the in-depth market analysis with future prospects of Cool Chain market. The study covers significant data which makes the research document a handy resource for managers, industry executives and other key people get ready-to-access and self analyzed study along with graphs and tables to help understand market trends, drivers and market challenges. Some of the key players mentioned
PINSTYLE’s ÜBER COOL “SHIT” PARTY , the global community of stylish people, is thrilled to have successfully partnered with German-born model/designer, Bonnie Strange in presenting her new collection, “The Shit.” On Saturday, 7th July, “The Shit Shop” opened in Berlin’s Prenzlauer Berg followed by a celebrity laden after-party attended by the likes of indie star Peaches. “The Shit,” specializes in vintage clothing, one-of-a-kind pieces from young designers and tattoos. The first fashion show for the
Cool idea could be worth cool million
Singapore firm first in the world to offer $1,000,000 US for "the next big thing" Got a great idea? You could just win a million bucks to turn that idea into reality. For aspiring entrepreneurs or business owners all over the world - as well as for the un- or underemployed who are anxious about their future but have a brilliant idea - there's some good news coming out of
Keeping Cool Outdoors with Alfresco Cooling
Alfresco Cooling now offers a way to cool any outdoor/indoor space. This solution to an age-old problem can turn areas that were once sweltering into cool, pleasant spaces that can be used all year long. This will allow businesses and homeowners to get maximum usage out of their outdoor spaces. The secret to outdoor temperature control is a simple fact of physics, the fact that evaporation requires energy. Every time water
EXASOL named a “Cool Vendor“
Leading Analyst Firm has named EXASOL in their Report 2011 for “Data Manage-ment” and “Integration”: the analyst company honors innovative and impactful new vendors with the title of “Cool Vendor” Nuremberg, Germany, April 27, 2011 – Gartner Inc. list EXASOL in the Cool Vendors in Data Management and Integration*, 2011 report. Gartner included the Nuremberg-based company based on the evaluation of its database EXASolution. EXASOL‘s relational high-performance database EXASolution offers