This article relies largely or entirely upon a single source. Relevant discussion may be found on the talk page. Please help improve this article by introducing citations to additional sources.(July 2012)
The Blackhole exploit kit is as of 2012 the most prevalent web threat, where 28% of all web threats detected by Sophos and 91% by AVG are due to this exploit kit. Its purpose is to deliver a malicious payload to a victim's computer. According to Trend Micro the majority of infections due to this exploit kit were done in a series of high volume spam runs. The kit incorporates tracking mechanisms so that people maintaining the kit know considerable information about the victims arriving at the kits landing page. The information tracked includes the victims country, operating system, browser and which piece of software on the victims computer was exploited. These details are shown in the kit's user interface.
Blackhole exploit kit was released on "Malwox", an underground Russian hacking forum.
The supposedly Russian creators use the names "HodLuM" and "Paunch". It was reported on the October 7, 2013 that "Paunch" has been arrested.
The customer licenses the Blackhole exploit kit from the authors and specifies various options to customize the kit.
A potential victim loads a compromised web page or opens a malicious link in a spammed email.
The compromised web page or malicious link in the spammed email sends the user to a Blackhole exploit kit server's landing page.
If there is an exploit that is usable, the exploit loads and executes a payload on the victim's computer and informs the Blackhole exploit kit server which exploit was used to load the payload.
A typical defensive posture against this and other advanced malware includes, at a minimum, each of the following:
Running a security utility with a good antivirus and good host-based intrusion prevention system (HIPS). Due to the polymorphic code used in generating variants of the Blackhole exploit kit, antivirus signatures will lag behind the automated generation of new variants of the Blackhole exploit kit, while changing the algorithm used to load malware onto victims' computers takes more effort from the developers of this exploit kit. A good HIPS will defend against new variants of the Blackhole exploit kit that use previously known algorithms.