In a recent Microsoft advisory, the company warned that the operators of BlackCat ransomware (aka ALPHV) is using exploits to gain access to target networks by exploiting unpatched Exchange server vulnerabilities.
Currently, ALPHV is in the early stage of operations and they have only a handful of the victims that have been identified to date. The researcher didn’t have the BlackCat gang’s initial entry vector, but when the gang breach the network they search and steal sensitive files and then encrypt local systems.
As BlackCat has a handful number of victims, they host the data of one or two victims in multiple leak sites and create new sites for new attacks.
Michael Gillespie, a malware analyst at Emsisoft and the author of tens of ransomware decryption utilities has mentioned the BlackCat as very sophisticated ransomware.
Other than BlackCat, BuerLoader, and FickerStealer ransomware developers have stepped up to use Rust as it is considered a much secure programming language compared to C and C++.
Threat actors can exploit the compromised Exchange servers in order to perform the following actions:-
- Access the target networks
- Conduct internal reconnaissance
- Lateral movement activities
- Steal sensitive files and documents
Since March 2022, 60 organizations worldwide have been compromised by the BlackCat ransomware, as reported by the FBI in April. It is the first ransomware designed in Rust, a modern programming language that is mainly used by threat actors to build ransomware programs, in particular.
BlackCat’s Payload capabilities
According to the Microsoft report, In addition to Targeting and Encrypting Windows and Linux devices, BlackCat is also capable of encrypting VMware servers. The payload was launched via dllhost.exe when the BlackCat payload did not have administrator privileges, which was the default launch method.
Following that, it launches several commands by means of cmd.exe. Depending on the environment, the BlackCat payload can be customized to execute the specific commands as required.
Here below we have mentioned all the capabilities of the BlackCat ransomware:-
- User account control (UAC) bypass
- Domain and device enumeration
- Self-propagation
- Hampering recovery efforts
RaaS scheme
RaaS schemes make use of the variables of initial access vectors to deliver the goal of stealing and encrypting target data. These encrypted files are then held ransom as part of what is referred to as double extortion techniques.
As a result of RaaS, cybercriminal ecosystems have been transformed into lucrative gig economies using three distinct key players that are:-
- Access brokers (IABs)
- Operators
- Affiliates
The other threat groups involved in the use of these ransomware families are DEV-0237 and DEV-0504, two of the most prolific and most prevalent affiliate threat groups.
Here are the ransomware families that are found to be distributing the BlackCat ransomware:-
- Hive
- Conti
- REvil
- LockBit 2.0
Here’s what Microsoft stated:-
“In the BlackCat-related incidents we’ve observed, the common entry points for ransomware affiliates were via compromised credentials to access internet-facing remote access software and unpatched Exchange servers. Therefore, defenders should review their organization’s identity posture, carefully monitor external access, and locate vulnerable Exchange servers in their environment to update as soon as possible.”
