BlackCat Ransomware group attacks on the rise

For a detailed advisory, download the pdf file here

The Blackcat Ransomware gang also known as ALPHV has targeted around 25 organizations belonging to multiple sectors globally since November 2021. The group has claimed responsibility for the recent cyber attack on Swissport which resulted in aircraft delays and service disruptions.

The current attack was carried out by first acquiring access via either leaked credentials or exposed vulnerable software. The attackers then disable defenses such as Windows Defender and increase the connection limit on remote connections for better data exfiltration. The Blackcat ransomware then terminates a series of pre-defined processes before beginning the encryption process with either AES or ChaCha20 encryption. Encrypted files have the extension “.sykffle” attached to them. Blackcat uses 7zip and Rclone to exfiltrate data, which is subsequently put on their website for sale if the ransom is not paid.

The notable capabilities of the ransomware written in rust include embedded PsExec, Powershell process migration capabilities, ability to infect VMWare ESXi service and also has built-in anti-recovery method that deletes the shadow volume copy using “vssadmin.exe”.

The user can mitigate the risk by following the recommendations: •Monitor the use of stolen credentials. •Have an effective backup strategy that ensures the backup are inaccessible from the endpoint. •Keep all operating systems and software up to date. •Implement a user training program and phishing exercises. •

The Techniques commonly used by Blackcat are:

TA0001: Initial Access

TA0002: Execution

TA0007: Discovery

TA0005: Defense Evasion

TA0040: Impact

TA0003: Persistence

TA0004: Privilege Escalation

TA0006: Credential Access

TA0011: Command and Control

TA0010: Exfiltration

T1027: Obfuscated Files or Information

T1007: System Service Discovery

T1059: Command and Scripting Interpreter

T1082: System Information Discovery

T1490: Inhibit System Recovery

T1485: Data Destruction

T1078: Valid Accounts

T1486: Data Encrypted For Impact

T1140: Encode/Decode Files or Information

T1202: Indirect Command Execution

T1543.003: Create or Modify System Process: Windows Service

T1550.002: Use Alternate Authentication Material: Pass the Hash

T1027.002: Obfuscated Files or Information: Software Packing

Actor Details

Indicators of Compromise (IoCs)

Recent Breaches