Rewterz Threat Alert – BlackCat Ransomware – Active IOCs

Severity

High

Analysis Summary

BlackCat – aka AlphaVM & AlphaV – is a Ransomware family that is deployed as a part of a Ransomware as a Service (RaaS). It is written in the Rust programming language and can run on Windows, Linux-based operating systems (Debian, Ubuntu, ReadyNAS, Synology), and VMWare ESXi.
This ransomware first appeared in November 2021. The majority of the group’s victims have been in the United States, although BlackCat and its associates have also targeted organizations in Europe, the Philippines, and other regions. Construction and engineering, retail, transportation, commercial services, insurance, machinery, professional services, telecommunication, auto components, and medicines are among the targeted sectors of BlackCat ransomware. This ransomware can be set to encrypt files using either the AES or ChaCha20 algorithms. It can destroy volume shadow copies, terminate programs and services, and stop virtual machines on ESXi servers to maximize the quantity of ransomed data.

Recently, the Federal Bureau of Investigation (FBI) of the United States published a flash report stating that BlackCat ransomware had compromised at least 60 organizations globally since its inception in November.

Impact

• File Encryption
• Data Theft

Indicators Of Compromise

MD5

• a45b51d65c12e10b318d870bf326540d

SHA-256

• 45b8678f74d29c87e2d06410245ab6c2762b76190594cafc9543fb9db90f3d4f

SHA-1

• 70f7aab12be880048a4632318f85fa9e94f1b770

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicator of compromise (IOCs)  in your environment utilizing your respective security controls
• Maintain cyber hygiene by updating your anti-virus software and implement patch management lifecycle.
• Maintain Offline Backups – In a ransomware attack, the adversary will often delete or encrypt backups if they have access to them. That’s why it’s important to keep offline (preferably off-site), encrypted backups of data and test them regularly.
• Emails from unknown senders should always be treated with caution.
• Never trust or open ” links and attachments received from unknown sources/senders.