Crimepack: Packed with Hard Lessons
Summary: Krebs on Security examined the administration pages of two working Crimepack exploit kit installations, one targeting mostly German-language sites where roughly 1,800 of nearly 6,000 visitors were hacked, and one targeting South American sites where 3,500 of 16,971 visitors were successfully attacked. In both cases a single Java Webstart flaw that Oracle/Sun patched in April 2010 accounted for the largest share of successful infections, nearly 60 percent in the first kit and more than two-thirds in the second.
What's compelling: One unpatched Java component most users did not know they had drove the majority of successful infections across two separate criminal operations, and Crimepack also let its customers test web reputation services to see whether any of them flagged the exploit sites.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026