A wide range of tools and software's are provided by Russian Underground Cybercrime both for beginners and advanced or say professional hackers. These tools enables them to target victims, finding and misusing the vulnerabilities. It doesn't need a lot of skills or experience to exploit the vulnerabilities in applications and which can be further used for spreading the malwares, because there are a ton of tools on sale that can help you out in it.

Case study

There was a post few months back on Russian Underground Cybercrime forum, that were offering an exploit, which was successful most of the time and was recorded as 95-96%, according to the seller. This was a few months back when this exploit was guaranteed to exploit an Adobe Flash Player vulnerability which was termed as CVE_2014_0497. But after few days when this vulnerability was exploited Adobe had provided a patch for it.

These vulnerabilities in the applications, can be used to execute arbitrary code and add malwares them . This seller named "insomnius", quoted in the form that this exploit was 95 percent successful on Firefox and internet explorer. So, there are a lots of such underground Cyber-crimes taking place, that are providing the exploits for sale. And talking about this "insomnius", there was no report seen afterwards as he had gone dark after this post.

Why instead of Patch, Exploits are successful?

So, after reading about case, the question that may be coming into your mind is that if the patches for exploits are available then why are the hackers interested in buying these patches?

The disheartening reality is that the patches are not proper at end users. IT groups are in struggle to ensure that these patches they are deploying would be working properly on all machines, and mainly the ones that are moving in and out of the company or organization.

Now, some of the applications that are very tough to be patched are Adobe Acrobat & Flash, Java, Excel, outlook, browsers and also media players you are using, have these vulnerabilities in them.

And the worst of all are the vulnerabilities that are not known publicly that are called Zero-Day exploits. As these exploits are rarely heard by anyone or are not in the eyes of public, so making patches for them is the most difficult task.