Exploit Kits Conditions Table
- Type/Plan
- Neutrino
- Price
- US$3,500 - US$7,000
- Duration
- Monthly
- Requirements
- Access to dark web forums
- Restrictions
- Limited to specific vulnerabilities
- Type/Plan
- Blackhole
- Price
- Varies
- Duration
- Hourly/Daily/Monthly
- Requirements
- Knowledge of exploit deployment
- Restrictions
- Availability may fluctuate
- Type/Plan
- Eleonore
- Price
- Uclarify
- Duration
- Hourly/Daily/Monthly
- Requirements
- Technical skills required
- Restrictions
- Targeting outdated software only
- Type/Plan
- Phoenix
- Price
- Uclarify
- Duration
- Hourly/Daily/Monthly
- Requirements
- Access to private channels
- Restrictions
- Not openly sold on dark web
- Type/Plan
- Office 365 EK
- Price
- High
- Duration
- Uclarify
- Requirements
- Knowledge of phishing techniques
- Restrictions
- Advanced security measures in place
Acquiring Darknet Market Exploit Kits
- Identify Exploit Kit Needs
Determine the specific vulnerabilities to target, such as those in web browsers or plugins like Flash, PDF, and Java[4]. Exploit kits (EK) are designed to discover and exploit these weaknesses to spread malware[1]. Historically popular kits include Blackhole, Eleonore, and Phoenix[4].
- Locate Sellers
Exploit kits are typically sold in forums rather than open marketplaces, unlike more standardized goods[2]. Since 2016, with the decline of kits like Angler, trafficking has shifted to private channels to avoid detection and patching [4, 8].
- Negotiate Terms and Price
Exploit kits can be rented by the hour, day, or month[2]. Prices vary; for instance, the Neutrino kit saw a 100% increase from US$3,500 to US$7,000 per month after Angler's disappearance[2]. Office 365 exploit kits are among the most expensive due to advanced security measures[5].
- Arrange Payment
Payment for exploit kits and other illicit dark web goods is typically conducted using cryptocurrencies, such as Bitcoin, to ensure anonymity[3].
- Receive Delivery
Delivery of exploit kits is electronic, often via email or a download link, to maintain anonymity[3]. Some sellers may bundle kits with tutorials on conducting attacks[5].
- Verify Functionality
After acquisition, verify the exploit kit's functionality. Exploit Kit-as-a-Service (EKaaS) models automate the initial stages of the cyberattack kill chain, from reconnaissance to installation, allowing users to focus on other aspects of their campaigns [10, 12].
Good to know
What is an exploit kit?
An exploit kit (EK) is a malicious software package designed to identify and leverage vulnerabilities in systems, particularly in outdated applications such as Java, Adobe Flash, and Silverlight[1]. These kits bundle multiple exploits targeting weaknesses in web browsers and their plugins to facilitate malware distribution[4].
How do exploit kits work?
Exploit kits operate by scanning a target system for known software vulnerabilities, and if found, they automatically deploy an exploit to compromise the system. This process automates the initial phases of a cyberattack, from reconnaissance to malware installation, allowing attackers to focus on other aspects like monetization[6].
What are the most common types of exploit kits?
Historically, popular exploit kits included Blackhole, Eleonore, and Phoenix[4]. In 2015, the Angler exploit kit was particularly prevalent, accounting for over 82% of observed attacks and infections[6]. The landscape shifted after Angler's decline in June 2016, leading to increased prices for other kits like Neutrino [4, 5].
How are exploit kits sold on darknet markets?
Exploit kits are typically trafficked in private channels and specialized forums rather than openly sold on darknet marketplaces, a shift that occurred to avoid detection by researchers and patching efforts [7, 8]. They are often offered under an 'Exploit Kit-as-a-Service' (EKaaS) model, making sophisticated attacks accessible to a wider range of threat actors.
What are the risks associated with exploit kits?
The primary risk associated with exploit kits is their ability to automate the infection process, allowing for widespread malware distribution and system compromise. This automation lowers the barrier to entry for cybercriminals, enabling even novice attackers to launch sophisticated campaigns and potentially gain unauthorized access or deploy ransomware [10, 13].
How can I protect myself from exploit kits?
Protection against exploit kits primarily involves maintaining up-to-date software, especially web browsers and their plugins, to patch known vulnerabilities that EKs target [1, 2]. Regular security audits and employing robust endpoint detection and response solutions can also help identify and mitigate potential threats before they can fully compromise a system.
Discover More on Darknet Security
Explore our extensive resources to enhance your knowledge.
View More ArticlesReading list
[1] Cybercrime Technical Desk Reference
[2] Cybercrime as a Service Series: Exploits as a Service
[3] Malware and Exploits on the Dark Web
[4] Manufacturing Compromise: The Emergence of Exploit-as-a-Service
[5] Dark Web hacking tools: Phishing kits, exploits, DDoS for hire and more
[6] Exploit Kits: The production line of the Cybercrime Economy