Monday, November 25, 2024
HomeRansomwareBeware!! BlackCat Ransomware Gang Attack Unpatched Microsoft Exchange Servers

Beware!! BlackCat Ransomware Gang Attack Unpatched Microsoft Exchange Servers

Published on

In a recent Microsoft advisory, the company warned that the operators of BlackCat ransomware (aka ALPHV) is using exploits to gain access to target networks by exploiting unpatched Exchange server vulnerabilities.

Threat actors can exploit the compromised Exchange servers in order to perform the following actions:-

  • Access the target networks
  • Conduct internal reconnaissance
  • Lateral movement activities
  • Steal sensitive files and documents

Since March 2022, 60 organizations worldwide have been compromised by the BlackCat ransomware, as reported by the FBI in April. It is the first ransomware designed in Rust, a modern programming language that is mainly used by threat actors to build ransomware programs, in particular.

- Advertisement - SIEM as a Service

BlackCat’s Payload capabilities

According to the Microsoft report, In addition to Targeting and Encrypting Windows and Linux devices, BlackCat is also capable of encrypting VMware servers. The payload was launched via dllhost.exe when the BlackCat payload did not have administrator privileges, which was the default launch method.

Following that, it launches several commands by means of cmd.exe. Depending on the environment, the BlackCat payload can be customized to execute the specific commands as required.

Here below we have mentioned all the capabilities of the BlackCat ransomware:- 

  • User account control (UAC) bypass
  • Domain and device enumeration
  • Self-propagation
  • Hampering recovery efforts

RaaS scheme

RaaS schemes make use of the variables of initial access vectors to deliver the goal of stealing and encrypting target data. These encrypted files are then held ransom as part of what is referred to as double extortion techniques.

As a result of RaaS, cybercriminal ecosystems have been transformed into lucrative gig economies using three distinct key players that are:-

  • Access brokers (IABs)
  • Operators
  • Affiliates

The other threat groups involved in the use of these ransomware families are DEV-0237 and DEV-0504, two of the most prolific and most prevalent affiliate threat groups.

Here are the ransomware families that are found to be distributing the BlackCat ransomware:-

  • Hive
  • Conti
  • REvil
  • LockBit 2.0

Here’s what Microsoft stated:-

“In the BlackCat-related incidents we’ve observed, the common entry points for ransomware affiliates were via compromised credentials to access internet-facing remote access software and unpatched Exchange servers. Therefore, defenders should review their organization’s identity posture, carefully monitor external access, and locate vulnerable Exchange servers in their environment to update as soon as possible.”

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Threat Actors Exploit Google Docs And Weebly Services For Malware Attacks

Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting...

Python NodeStealer: Targeting Facebook Business Accounts to Harvest Login Credentials

The Python-based NodeStealer, a sophisticated info-stealer, has evolved to target new information and employ...

XSS Vulnerability in Bing.com Let Attackers Send Crafted Malicious Requests

A significant XSS vulnerability was recently uncovered in Microsoft’s Bing.com, potentially allowing attackers to...

Meta Removed 2 Million Account Linked to Malicious Activities

 Meta has announced the removal of over 2 million accounts connected to malicious activities,...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Helldown Ransomware Attacking VMware ESXi And Linux Servers

Helldown, a new ransomware group, actively exploits vulnerabilities to breach networks, as since August...

Phobos Ransomware Admin as Part of International Hacking Operation

The U.S. Department of Justice unsealed criminal charges today against Evgenii Ptitsyn, a 42-year-old Russian...

Black Basta Ransomware Leveraging Social Engineering For Malware Deployment

Black Basta, a prominent ransomware group, has rapidly gained notoriety since its emergence in...