BlackCat (ALPHV)

Compromised Credentials: Frequently, stolen credentials obtained from initial access brokers or previous data breaches are used.

Social Engineering: Advanced social engineering techniques, including phone calls and SMS messages posing as IT or helpdesk staff, are employed to trick users.

Phishing: Sophisticated phishing campaigns with malicious attachments or links.

Exploitation of Known Vulnerabilities: Targeting unpatched vulnerabilities in publicly facing applications and services.

Malvertising/SEO Poisoning: BlackCat has been observed using malicious ads to trick users into downloading malware that delivers a Cobalt Strike beacon.

Remote Access Software: Tools like AnyDesk, Mega sync, and Splashtop are used for remote access and control.

Legitimate Tools: BlackCat leverages legitimate remote access/tunneling tools like Plink and Ngrok.

Command and Control: Brute Ratel C4 and Cobalt Strike are employed for command and control.

Credential Theft: The attackers actively steal credentials from domain controllers, local networks, and backups.

Kerberos Token Generation: Kerberos tickets are generated to gain domain access.

MFA Bypass: The Evilginx2 adversary-in-the-middle framework has been used to bypass multi-factor authentication.

Active Directory Enumeration: Leveraging tools to gather information about Active Directory and identify high-value targets.

Allowlisting: BlackCat attempts to allowlist applications (e.g., Metasploit).

Log Clearing: Logs on Exchange servers are cleared to remove traces of activity.

UAC Bypass: The CMSTPLUA COM interface is used to bypass User Account Control.

Junk Code & Encrypted Strings: Techniques like junk code and encrypted strings are used to avoid detection. Exploring CyberChef may help in decoding some of the junk code.

Data Exfiltration: Data is often exfiltrated before encryption, using services like Mega.nz and Dropbox. This is used for double extortion.

Encryption: Files are encrypted using AES or ChaCha20, with the AES key then encrypted using an RSA public key embedded in the configuration. Understanding asymmetric encryption can help to understand the process.

File Naming Convention: Encrypted files typically have a seven-digit extension and are accompanied by a ransom note named "RECOVER-(seven-digit extension)-FILES.txt."

Intermittent Encryption: Blackcat was an early adopter of intermittent encryption, where only parts of files are encrypted to increase the attack speed.

Triple Extortion: In some cases, BlackCat has employed triple extortion, adding DDoS attacks to data encryption and exfiltration. Protecting from DDoS attacks is very essential in such situation.

Public Data Leak Site: BlackCat was a pioneer in using a public data leak site on the open internet (not just the dark web) to pressure victims. Some affiliates even mimic victims' websites to post stolen data.

Ransom Demands: Ransom demands typically range in the millions of dollars, payable in Bitcoin or Monero. A detailed understanding of cryptocurrency is important in this case.

Unsolicited Remediation: BlackCat offers "vulnerability reports" and "security recommendations", as an incentive to pay the ransom. The process of vulnerability assessments is also important.

Lists of services/processes to stop.

Whitelisted directories/files/extensions.

Stolen credentials.

RSA public key.

Ransom note details.

Boolean values controlling behavior.

Implement application controls (allowlisting) to restrict the execution of unauthorized software.

Follow CISA's guidance on securing remote access software.

Implement strong MFA, preferably FIDO/WebAuthn or PKI-based MFA, which is resistant to phishing and adversary-in-the-middle attacks.

Refer to CISA's fact sheet on implementing phishing-resistant MFA.

Implement robust network monitoring tools to log and report network traffic, including lateral movement.

Utilize Endpoint Detection and Response (EDR) tools to detect and respond to malicious activity on endpoints. Splunk can be a good option in such cases.

Segment networks to limit the spread of ransomware in case of a breach.

Educate users on social engineering and phishing techniques.

Conduct regular phishing simulations to test user awareness.

Establish a baseline for internal mail and messaging traffic and monitor for deviations.

Regularly scan for and patch vulnerabilities, especially in internet-facing systems.

Prioritize patching of known exploited vulnerabilities. Patch management strategy is crucial.

Implement a robust data backup and recovery plan.

Ensure backups are stored offline and regularly tested.

Develop and regularly test an incident response plan that includes procedures for ransomware attacks. A Cyber Incident Response Plan is very important in such cases.

Install and maintain up-to-date antivirus software on all endpoints.

Leverage CISA's free cyber hygiene services.

Advocate for software manufacturers to incorporate secure by design principles.

Actively test security controls against the MITRE ATT&CK techniques used by BlackCat.