jre7u21 and earlier Click-2-Play Warning Bypass integrating Exploit Kits

A new variant of a "Kore-ish" Cool EK appeared few days ago.
Yes...it's difficult to follow the EK fast moving landscape...No payload in the jar for that one.

Some instances of this "Cool EK"  in URLQuery

I faced it often where I used to see Kore (aka Sibhost) Exploit Kit.
It is also used to spread the Urausy Ransomware and FakeAV (so... BestAV stuff)

All jar found there were identical as those in Blackhole. Till today.

CVE-2013-2460 + Click2Play Bypass :

That CVE was already in use in Private Exploit Pack but it was noisy (Imposition then made it optional )

CVE-2013-2460 successfull path in Cool EK (Kore-ish) Click2Play Bypass inside 2013-09-20

GET http://[redacted].tacogratis .com/index.php?p=5267
200 OK (text/html)

Key Piece of the landing

GET http://[redacted].tacogratis .com/index.php?p=5290
200 OK (text/javascript)

GET http://[redacted].tacogratis .com/index.php?p=5268 fb1decbef1c4361eb421a3496201ef30
200 OK (application/java-archive)

GET http://[redacted].tacogratis .com/index.php?p=5268
200 OK (application/java-archive)

GET http://cghtuj.tacogratis .com/index.php?p=5275&e=14
200 OK (application/x-msdownload)  170896de44d75651bbbd9358b0f11c34 (Urausy Ransomware)

----- Off Topic ----
Payload is rotating fast (2 more md5) :
b56348220f83ad9db50cb5beb564148b
64ef8f2cb215af4b2fbcb51cadfcc025

Urauy Ransomware - DE design - 2013-09-20 (BestAV soft 2)

Note : on another thread you can get  a FakeAV

Payload call with bigger charge

9d8d3094849f685859945140721aafb1
7fb9423c4bdf7080137745e81ba38362
13e24b552ea472146495ac8a33cca975

Other payload from this "Kore-ish" Cool EK (BestAV Soft1)

-------------------

So what's that  Click2Play bypass ?

Quite surely : http://seclists.org/bugtraq/2013/Jul/41
2013-06-18 - Vulnerability Fixed in Java 7u25

Yes :

Warning with jre7u25 (and as CVE-2013-2460 is patch too...clicking on run there won't put you at risk)

It's the first time I see that.
5 days ago :

EKs vs jre7u21 : http://t.co/jCkdtnp7NW
— kafeine (@kafeine) September 15, 2013

Who sold it ?
??

No download link for now. Yes it will spread fast anyway.
It's easy to get rid of all these Exploit Kits : update !

<edit1 2013-09-21>
Already in Sakura...surely cause of that blog post. It's often difficult to decide how much you can write about something.

Sakura CVE-2013-2460 & Click2Play Bypass :

Sakura featuring CVE-2013-2460 & Click2Play bypass 2013-09-21

GET http://[redacted]253 .pw:8509/me.php
200 OK (text/html)