Netskope Threat Labs

BlackHole

ATP Sandbox Adv. HeuristicsAV

Description

BlackHole is an exploit kit that criminals used from 2010 to 2013 to deliver malware through drive by web attacks. Hosted on compromised and criminal controlled sites, it probed visitors for browser and plugin vulnerabilities, exploited any weakness it found, and downloaded payloads onto the machine. It dominated the criminal market until the 2013 arrest of its main developer, and its decline pushed malware operators toward spam and social engineering delivery.

Stats

First seen
February 2022
Last seen
October 2026

Also known as

Blackhole

Alert name variants

Alert Name
DeepScan:Generic.JS.BlackHole.FFFFFFFE
Exploit.BlackHole.Script.A
Exploit.BlackHole.Script.AD
Exploit.BlackHole.Script.AF
Exploit.BlackHole.Script.B
Exploit.BlackHole.Script.D
Exploit.BlackHole.Script.E
Exploit.BlackHole.Script.F
Exploit.BlackHole.Script.G
Exploit.BlackHole.Script.H

References