BlackCat, otherwise known as ALPHV, has carved its niche in the cyber-threat landscape. Its unconventional Rust programming language and ability to target a wide array of devices and potential entry points have placed it in the limelight. Originating from prolific threat activity groups, its first sightings trace back to November 2021.
An Innovative Approach to Ransomware
Leveraging Rust, a contemporary programming language, BlackCat adeptly avoids detection, especially by traditional security measures. This sophisticated ransomware can infiltrate an array of devices and operating systems, from Windows and Linux devices to VMWare instances.
Ransomware-as-a-Service: A Collaborative Threat
BlackCat adopts the Ransomware-as-a-Service (RaaS) model, involving a network of malicious actors. Access brokers compromise networks, RaaS operators craft tools, and RaaS affiliates execute activities like lateral network movement and data exfiltration before initiating the ransomware payload. Consequently, BlackCat’s infiltration techniques differ depending on the RaaS affiliate deploying it.
You might want to read about the Cl0p Ransomware group
BlackCat: A Global Menace
The myriad of variations and adaptations heightens the likelihood of an organization encountering BlackCat. Detecting and mitigating this threat becomes increasingly challenging as each threat actor uses different tactics, techniques, and procedures. As such, each BlackCat deployment can present a unique set of threats. Its footprint spans various countries across all continents.
The Payload Capabilities of BlackCat
BlackCat possesses expansive capabilities, including self-propagation, which affiliates can tailor to their requirements and the environment they encounter. Notably, if the BlackCat payload doesn’t secure administrator privileges, it launches through dllhost.exe, which then executes specific commands via cmd.exe.
The Evolution of BlackCat (Alphv)
Fast forward to April 2023, Alphv (or BlackCat/Noberus) ascends as the second most active ransomware group, accounting for 14% of total victims. The collective believed to be behind Alphv consists of experienced ransomware operators from notorious groups such as REvil, Darkside, and BlackMatter. It has claimed 271 victims over the past year, mostly within industries like Manufacturing, Legal, Banking & Finance, Technology, and Construction.
High Stakes and Coercive Tactics
Alphv implements “double-extortion” tactics, threatening to leak exfiltrated sensitive data to coerce victims into paying the ransom. They further escalate these methods to “triple-extortion” by threatening Distributed Denial of Service (DDoS) attacks or selectively publishing information to tarnish the reputation of non-compliant victims. Initial ransom demands for larger victims can range from $2.5 million to over $10 million USD.
Initial Access Methods of Alphv
Alphv commonly infiltrates systems through exploiting Microsoft Exchange Server vulnerabilities and using compromised credentials to secure remote access. It has also been observed to use the Emotet botnet for ransomware deployment and the offensive security tool, Cobalt Strike.
Escalating Coercion Tactics
An incident with Western Digital, a victim of Alphv’s ransomware, illustrated the aggressive escalation of Alphv’s tactics. Following an unpaid “8 figure” ransom, Alphv publicly targeted Western Digital, releasing screenshots of emails, Teams chats, and even a Zoom meeting. This demonstrated Alphv’s ongoing access to the victim’s environment amid their struggle to respond.
Shielding Against BlackCat (Alphv)
he human-operated ransomware attacks exemplified by BlackCat continue to evolve, becoming a favored approach for attackers to monetize their operations. It’s imperative for organizations to strengthen their security practices, adopt comprehensive solutions that can correlate various threat signals to detect and block such attacks and their subsequent activities.
For an in-depth understanding of this ransomware, delve into specific incidents involving BlackCat deployment, the threat activity groups behind it, and the best practices for shielding against this menacing threat.
Sources used:
- Microsoft Security Blog: The many lives of BlackCat ransomware
- GuidePoint Security: GRIT Ransomware Report: April 2023
Done reading? Continue with “Understanding LockBit 3.0 Ransomware Threat“.
