Sweet Orange Exploit Kit was the new king of the hill, until it went away.
Summary: After the arrest of the author of the Blackhole and Cool exploit kits, known as "paunch," Blackhole prevalence fell to almost zero from its last high point on October 9, and the Crypt.am site used to encrypt the kit went offline. Sweet Orange surged about 214% shortly after the arrest, moving the port hosting its landing page and exploits at least three times, before it too disappeared around October 17; Cisco Talos reported that 98% of compromises came through Java.
Key Takeaway: One arrest reshuffled the exploit kit market within days, and 98% of the compromises Talos observed ran through Java in the browser - a single plugin setting sitting between your users and nearly every one of those infections.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026