FBI Releases IOCs Associated with BlackCat/ALPHV Ransomware

0 0
Read Time:1 Minute, 54 Second

The Federal Bureau of Investigation (FBI) has released a Flash report detailing indicators of compromise (IOCs) associated with attacks involving BlackCat/ALPHV, a Ransomware-as-a-Service that has compromised at least 60 entities worldwide.

CISA encourages users and administrators to review the IOCs and technical details in FBI Flash CU-000167-MW and apply the recommended mitigations. 

FBI in its Flash Reprot warns of BlackCat Ransomware that Breached Over 60 Organisations Worldwide. Also called ALPHV and Noberus, the ransomware is notable for being the first-ever malware written in the Rust programming language that’s known to be memory safe and offer improved performance.

“Many of the developers and money launderers for BlackCat/ALPHV are linked to DarkSide/BlackMatter, indicating they have extensive networks and experience with ransomware operations,” the FBI said in an advisory published last week.

The disclosure comes weeks after twin reports from Cisco Talos and Kasperksy uncovered links between BlackCat and BlackMatter ransomware families, including the use of a modified version of a data exfiltration tool dubbed Fendr that’s been previously only observed in BlackMatter-related activity.

“Aside from the developing advantages Rust offers, the attackers also take advantage of a lower detection ratio from static analysis tools, which aren’t usually adapted to all programming languages,” AT&T Alien Labs pointed out earlier this year.

Like other RaaS groups, BlackCat’s modus operandi involves the theft of victim data prior to the execution of the ransomware, with the malware often leveraging compromised user credentials to gain initial access to the target system.

The law enforcement agency, besides recommending victims to promptly report ransomware incidents, also said it doesn’t encourage paying ransoms as there is no guarantee that this will enable the recovery of encrypted files. But it did acknowledge that victims may be compelled to heed to such demands to protect shareholders, employees, and customers.

As recommendations, the FBI is urging organizations to review domain controllers, servers, workstations, and active directories for new or unrecognized user accounts, take offline backups, implement network segmentation, apply software updates, and secure accounts with multi-factor authentication.

Source:

FBI Releases IOCs Associated with BlackCat/ALPHV Ransomware | CISA

FBI Warns of BlackCat Ransomware That Breached Over 60 Organisations Worldwide (thehackernews.com)

Happy
Happy
0 %
Sad
Sad
0 %
Excited
Excited
0 %
Sleepy
Sleepy
0 %
Angry
Angry
0 %
Surprise
Surprise
0 %

Average Rating

5 Star
0%
4 Star
0%
3 Star
0%
2 Star
0%
1 Star
0%

Leave a Reply

Your email address will not be published.