Saturday, November 2, 2024
HomeRansomwareBeware!! BlackCat Ransomware Gang Attack Unpatched Microsoft Exchange Servers

Beware!! BlackCat Ransomware Gang Attack Unpatched Microsoft Exchange Servers

Published on

Malware protection

In a recent Microsoft advisory, the company warned that the operators of BlackCat ransomware (aka ALPHV) is using exploits to gain access to target networks by exploiting unpatched Exchange server vulnerabilities.

Threat actors can exploit the compromised Exchange servers in order to perform the following actions:-

  • Access the target networks
  • Conduct internal reconnaissance
  • Lateral movement activities
  • Steal sensitive files and documents

Since March 2022, 60 organizations worldwide have been compromised by the BlackCat ransomware, as reported by the FBI in April. It is the first ransomware designed in Rust, a modern programming language that is mainly used by threat actors to build ransomware programs, in particular.

- Advertisement - SIEM as a Service

BlackCat’s Payload capabilities

According to the Microsoft report, In addition to Targeting and Encrypting Windows and Linux devices, BlackCat is also capable of encrypting VMware servers. The payload was launched via dllhost.exe when the BlackCat payload did not have administrator privileges, which was the default launch method.

Following that, it launches several commands by means of cmd.exe. Depending on the environment, the BlackCat payload can be customized to execute the specific commands as required.

Here below we have mentioned all the capabilities of the BlackCat ransomware:- 

  • User account control (UAC) bypass
  • Domain and device enumeration
  • Self-propagation
  • Hampering recovery efforts

RaaS scheme

RaaS schemes make use of the variables of initial access vectors to deliver the goal of stealing and encrypting target data. These encrypted files are then held ransom as part of what is referred to as double extortion techniques.

As a result of RaaS, cybercriminal ecosystems have been transformed into lucrative gig economies using three distinct key players that are:-

  • Access brokers (IABs)
  • Operators
  • Affiliates

The other threat groups involved in the use of these ransomware families are DEV-0237 and DEV-0504, two of the most prolific and most prevalent affiliate threat groups.

Here are the ransomware families that are found to be distributing the BlackCat ransomware:-

  • Hive
  • Conti
  • REvil
  • LockBit 2.0

Here’s what Microsoft stated:-

“In the BlackCat-related incidents we’ve observed, the common entry points for ransomware affiliates were via compromised credentials to access internet-facing remote access software and unpatched Exchange servers. Therefore, defenders should review their organization’s identity posture, carefully monitor external access, and locate vulnerable Exchange servers in their environment to update as soon as possible.”

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Hackers Use Fog Ransomware To Attack SonicWall VPNs And Breach Corporate Networks

Recent cyberattacks involving Akira and Fog threat actors have targeted various industries, exploiting a...

Four Evil Ransomware Operators Sentenced For Hacking Enterprises

The St. Petersburg Garrison Military Court has sentenced four individuals involved in a notorious...

10 Best Linux Distributions In 2024

The Linux Distros is generally acknowledged as the third of the holy triplet of...