May 12, 2025
Proactive Defense: The Importance of Incident Response Planning in Cybersecurity
Rewterz Threat Alert – Witchetty APT Group Hides Backdoor Malware In Windows Logo – Active IOCs
October 3, 2022Rewterz Threat Alert – Donot APT Group – Active IOCs
October 4, 2022Rewterz Threat Alert – Witchetty APT Group Hides Backdoor Malware In Windows Logo – Active IOCs
October 3, 2022Rewterz Threat Alert – Donot APT Group – Active IOCs
October 4, 2022
Severity
High
Analysis Summary
BlackCat – aka AlphaVM & AlphaV – is a Ransomware family that is deployed as a part of a Ransomware as a Service (RaaS). It is written in the Rust programming language and can run on Windows, Linux-based operating systems (Debian, Ubuntu, ReadyNAS, Synology), and VMWare ESXi.
This ransomware first appeared in November 2021. The majority of the group’s victims have been in the United States, although BlackCat and its associates have also targeted organizations in Europe, the Philippines, and other regions. Construction and engineering, retail, transportation, commercial services, insurance, machinery, professional services, telecommunication, auto components, and medicines are among the targeted sectors of BlackCat ransomware.
This ransomware can be set to encrypt files using either the AES or ChaCha20 algorithms. It can destroy volume shadow copies, terminate programs and services, and stop virtual machines on ESXi servers to maximize the quantity of ransomed data.
Indicators Of Compromise
MD5
- a7094dede83e5d6e7567ee3e77a0bc5b
SHA-256
- 72f0981f18b969db2781e874d249d8003c07f99786e217f84cf54a148de259cc
SHA-1
- c5e9d39e259a322a237ebedb29bb3fd00b2a1ddf
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.
