Experts Find Some Affiliates of BlackMatter Now Spreading BlackCat Ransomware

An analysis of two ransomware attacks has identified overlaps in the tactics, techniques, and procedures (TTPs) between BlackCat and BlackMatter, indicating a strong connection between the two groups.

While it’s typical of ransomware groups to rebrand their operations in response to increased visibility into their attacks, BlackCat (aka Alphv) marks a new frontier in that the cyber crime cartel is built out of affiliates of other ransomware-as-a-service (RaaS) operations.

BlackCat first emerged in November 2021 and has since targeted several organizations worldwide over the past few months. It has been called out for being similar to BlackMatter, a short-lived ransomware family that originated from DarkSide, which attracted notoriety for its high-profile attack on Colonial Pipeline in May 2021.

In an interview with Recorded Future’s The Record last month, a BlackCat representative dismissed rumors that it’s a rebranding of BlackMatter, while noting that it’s made up of affiliates associated with other RaaS groups.

“In part, we are all connected to gandrevil [GandCrab / REvil], blackside [BlackMatter / DarkSide], mazegreggor [Maze / Egregor], lockbit, etc., because we are adverts (aka affiliates),” the unnamed representative was quoted as saying. “We borrowed their advantages and eliminated their disadvantages.”

“BlackCat seems to be a case of vertical business expansion,” Cisco Talos researchers Tiago Pereira and Caitlin Huey said. “In essence, it’s a way to control the upstream supply chain by making a service that is key to their business (the RaaS operator) better suited for their needs and adding another source of revenue.”

What’s more, the cybersecurity firm said it observed a number of commonalities between a BlackMatter attack in September 2021 and that of a BlackCat attack from December 2021, including the tools and the file names used as well as a domain employed to maintain persistent access to the target network.

This overlapping use of the same command-and-control address has raised the possibility that the affiliate that used BlackMatter was likely one of the early adopters of BlackCat, with both the attacks taking more than 15 days to reach the encryption stage.

“As we have seen several times before, RaaS services come and go. Their affiliates, however, are likely to simply move on to a new service. And with them, many of the TTPs are likely to persist,” the researchers said.

The findings come as BlackBerry detailed a new .NET-based ransomware family called LokiLocker that not only encrypts the files but also incorporates an optional wiper functionality that’s designed to erase all non-system files and overwrite the master boot record (MBR) should a victim refuse to pay up within a specified timeframe.

“LokiLocker works as a limited-access ransomware-as-a-service scheme that appears to be sold to a relatively small number of carefully vetted affiliates behind closed doors,” the researchers said. Active since at least August 2021, a majority of victims detected so far are concentrated in Eastern Europe and Asia.

Tagi:

Podziel się postem :)

Najnowsze:

Bezpieczeństwo

Kolejna fala oszustw ,,na PGE”

SMS od PGE z informacją o zaplanowanym odłączeniu energii elektrycznej to popularna metoda cyberprzestępców. Oszuści, podszywając się pod Polską Grupę Energetyczną, chcą podstępem pozyskać nasze dane. Cel jest jeden.

Militaria

Alrosa – symbol rosyjskiej floty wraca na morze

Jedyny w swoim rodzaju rosyjski okręt podwodny o nazwie “Alrosa” powrócił na morze. Po modernizacji i zainstalowaniu nowego uzbrojenia ma być głównym elementem floty biorącej udział w agresji na Ukrainę. Rosjanie chwalą się, że jest w stanie zastąpić sześć okrętów. Dlaczego jest tak wyjątkowy?

Bezpieczeństwo

Blisko 66 000 złotych straciła 55- letnia mieszkanka Staszowa w wyniku oszustwa

Blisko 66 000 złotych straciła 55- letnia mieszkanka Staszowa w wyniku oszustwa. Kobieta była przekonana, że odebrała połączenie od pracownika banku, a kolejno od stołecznego policjanta. Otworzyła przesłany za pomocą komunikatora link, i to wystarczyło, aby w efekcie końcowym oszuści wypłacili z jej rachunku bankowego zgromadzone środki oraz zaciągnęli pożyczkę.

Dodaj komentarz

Twój adres e-mail nie zostanie opublikowany.