Paunch's arrest...The end of an Era !

snipshot of : Spin up of a Supermassive Black Hole  Illustration Credit: Robert Hurt, NASA/JPL-Caltech

Note: This post is a work in progress. Not all group have transitioned. So I will update (if I am able to spot them again) and add some links to significant external posts.
Disclaimer: I do not have the telemetry Antivirus or IDS Vendor can have...sure we could have a better picture than that.


If you are reading this you already know that Paunch, the coder behind Blackhole, has been arrested.


What i will try to cover here is the transition/impact of this on the groups using the Blackhole/Cool EK weapon.
The evolution of what i can see from the "driveby battlefield".

The Actors :

Here are the main groups I am aware of who were using the Blackhole or the Cool EK at the time of arrest. I will describe the distribution, the threats but won't talk (maybe only for now) about the way they handle the "poke a mole" with the Defense (Domains, IPs).

- "Reveton Team" or "Mr.J/MonsterAV" : Cool EK lately on tcp 1024

Cool EK "Reveton" - 2013-10-07 01:37

First customer from Cool EK. I would say their golden age was 1 year ago. They were infecting more than 30k machines a day with Reveton when Cool EK was released (stats were easy to gather)
Distribution : Traffic coming from multiple sources including lately CookieBomb ("Tale of the North" Iframer)
Threat : Mainly Reveton (some Live Security Professional?) . Hundreds of Samples a day. Around 30 threads.

- One Urausy affiliate member (or BestAV itself??) : Cool EK /index.php?p=

Cool EK "Urausy/FakeAV"& Urausy Calling Home 2013-10-04 07:00

Distribution : From what I saw mainly Porn Malvertising and few compromised websites.
Threat : Urausy / Fake AV. See: The missing link - Some lights on "Urausy" affiliate 2013-05-29

- Home Gang  (or q.php or Darkleech fuelled) :

/Home/ Blackhole - 2013-09-30

Distribution : Traffic from Darkleech Module (installed on compromised server via Cpanel/ Parallels Plesk vulns)
Filtering IE only both on the Darkleech Side and on the Blackhole itself.
Threat : They were pushing Pony which was then (depending of your country) pushing Urausy or Nymaim.b (which itself was loading Zaccess or Nymaim.a Ransomware). 1 thread, around 30 rotation a day.

See : Late Disclosure - Darkleech Actors /Home/ - some numbers 2013-10-10 (more reading there)

- Ex-Tkr  /i/last blackhole (or CDorked.A Fuelled) :

Ex-Tkr Blackhole Pushing Carberp.J (MS) aka Glupteba.G (Eset) 2013-09-16

Distribution : As far as i know mostly Cdorked.A module installed on server running compromised Cpanel/Parallels Plesk, and some fake porn website
Threats : 3 threads, 2 payloads familly : Carberp.J (200ko) and Leechole (50ko)
More than 240 samples a day (15-20 for Carberp - and around 110 for each Leechole).

See: Linux/Cdorked.A malware: Lighttpd and nginx web servers also affected 2013-05-07 Marc-Etienne M. Léveillé 2013-07-05

- /closest/ Blackhole :

BH EK Closest pushing the STI (pay per install clickfraud) Payload 2013-09-26

Distribution : Lately, mainly LinkedIn spam redirecting to some compromised wordpress.
Threats : Zaccess, Cutwail, STI (Pay Per install clickfraud affiliate tied to Zaccess). They pushed some Cridex in the past too.

- /topic/  - Zeus Game Over gang :

/topic/ BH EK pushing  2 payloads (ZGO & Dipverdle (a loader) ) 2013-09-30

- /ngen/ Blackhole

/Ngen/ Blackhole pushing Citadel (you can see the call home : /ckt/ ) and Zaccess 2013-09-11

Note the duqu like front drop (shrift.php - CVE-2011-3402)
Distribution : A lot of compromised website with a TDS sharing (hosted with?) the infrastructure of the Blackhole. (/sword/in.cgi may remind you things)
Threats : Shylock, Zaccess, those day (but some Sinowal, Ursnif, Zbot, Citadel in the past too)

- /xlawr/ Blackhole

/xlawr/ Blackhole pushing FakeRean 2013-09-27

Threats : 2 threads around 50 samples a day: Zaccess and FakeRean 855ko

- Customer "hosted 1" in Rented mode (will cover the main based on traffic amount and longevity).

Distribution : Compromised website, 2 step (with a js on another compromised site as TDS)
Threat : 1 thread, 3 payloads. (i didn't try to define for now - will do).


- /news/ Blackhole

/news/ BH EK pushing Zeus Game Over

Threats : fast rotating thread...hard to follow. Lately pushing ZeusGameOver
But in the past they were pushing Cridex/Bugat, or Inlev.B gathering Tesch.A (Zaccess?), or Ursniff
Some of their domains : bbb-complaints.org, pinformer.net, cool-mail.net
They are not new in the business : http://blog.dynamoo.com/2012/06/wire-transfer-hp-spam-and.html
Some Urlquery traces

- /vague/ Blackhole

This blackhole was hard to find. It was the infector for the Citadel /ppp/ that made some noise for being Japan and Germany focused.

Live Infection vector for the Citadel targeting japan illustrated cc @Xylit0l@unixfreaxjphttps://t.co/zkDLHV0EDYpic.twitter.com/ahtg3jJQ5l
— kafeine (@kafeine) September 3, 2013

I won't talk about /adfasdfksjdfn/ Sinowal BH EK (while still reachable it's not in use anymore) neither the white/purple Cool EK which is blinking (and quite surely built on a leak of Cool EK Code) neither the /reveals/ or /news/ blackhole  (except if i spot the groups after transition).

That day: 2013-10-07

BREAKING: Blackhole exploit kit author "Paunch" and his partners arrested in Russia #Blackhole#Paunch#ExploitKit#Malware
— Maarten Boone RCX (@staatsgeheim) October 7, 2013

This was ground breaking for me...Seeing the source that could only be true.
That really sounds like....malware now need coffee ...or anxiolytic.

I tried to find some kind of evidences.

Crypt.am down. #Paunchpic.twitter.com/HZKkJ5Nb6S
— kafeine (@kafeine) October 7, 2013

I knew it was up few days earlier cause I gave it a visit again after the  "Expanding Business: JavaScript Cryptor Offered by Author of Blackhole Exploit Kit" post from Fortinet. (2013-10-01)

Two hours after the tweet, Underground started to react.

Verified :

Verified - Cleaning Mode 2013-10-07 Few hours after the tweet goes viral.

Exploit .in :

Paunch Blackhole forum thread :
Removed.
I also noticed that "Sweet Orange" account was active (trying to get some news I guess).
Nuclear Pack was not anymore on both of these forum but still on darkode.

Neutrino Author's reaction :
Price increase for non Russian customers to 10k/month
<edit:2013-10-11>Now 1 000 000$ per month - See advert here : http://pastebin.com/raw.php?i=6xZDGadQ </edit>

Since then we can see some actors trying to reach Paunch associates in Cool EK or find new solution

"желаю Панчу мужества и побыстрее решить проблемы, но несмотря ни на что работать то нужно"
that mean something like :
"I wish Paunch courage and quickly solve the problem, but no matter what we need to work"

or

"Ребят, если кто работал с панчем по приватному проекту связки - дайте знать. Я - один из клиентов. "
that can be translated as :
"Guys, if anyone has worked with Paunch for a private Exploit Kit project - let me know. I am one of the clients."

That same day i tried to make a "photo" of the battlefield state (going on each of the exploit kit illustrated here)

2013-10-07 - between 2 and 3  hours after the news goes viral

What can we see : The Rented Blackhole are already out.
The Darkleech/Home one is also 502ing.
(I was wondering if the operators are not part of the "partners" mentionned in the tweet).
ALL exploit kit are using an almost 4 days old Jar.
In fact it's a simplification cause there are 3 jars (depending of your config) which are :

3bebb777a0b3e7d416a6327a4777b630 - CVE-2013-2465
c61923eb060b42b6d27373b2d44e7839 - CVE-2013-2460
3478966161745cf3401b2a534523a4bc - CVE-2013-0422
And guess what ? you still can't find newer one on Blackhole.
Just now :

Sploit folder state in one of those blackhole. 2013-10-11

The Transition :

- "Reveton Team" or "Mr.J/MonsterAV" : 

2013-10-07 5 hours after the tweet Reveton team has already switched to WhiteHole

Reveton team transitionning from WhiteHole (tcp 2780) to .... Something New on tcp80 - 2013-10-08 ProTransition ! No interruption.

Angler EK pushing Reveton 2013-10-08

Advert for Reveton/Live Security Pro Distribution (nice Angler Fish ! )

---------------------------------
If you have any intel, information, question about this, I'd love to hear about it. kafeine@dontneedcoffee.com
Clarification: I did not contact Media as it is written here or there. I only replied to questions I received in my mailbox following some tweets (please consider it before thinking : "Media Whore").

PS  : Sharing is part of our defenses. Crediting is part of the trust/sharing process. You can freely use data from here but please, don't be a douchebag, credit your source. Each time I see/read/hear someone bragging with data he easily gathered here (without crediting)... the idea "stop the share""pop" in my mind.