Thursday, May 15, 2025
HomeRansomwareBeware!! BlackCat Ransomware Gang Attack Unpatched Microsoft Exchange Servers

Beware!! BlackCat Ransomware Gang Attack Unpatched Microsoft Exchange Servers

Published on

SIEM as a Service

Follow Us on Google News

In a recent Microsoft advisory, the company warned that the operators of BlackCat ransomware (aka ALPHV) is using exploits to gain access to target networks by exploiting unpatched Exchange server vulnerabilities.

Threat actors can exploit the compromised Exchange servers in order to perform the following actions:-

  • Access the target networks
  • Conduct internal reconnaissance
  • Lateral movement activities
  • Steal sensitive files and documents

Since March 2022, 60 organizations worldwide have been compromised by the BlackCat ransomware, as reported by the FBI in April. It is the first ransomware designed in Rust, a modern programming language that is mainly used by threat actors to build ransomware programs, in particular.

- Advertisement - Google News

BlackCat’s Payload capabilities

According to the Microsoft report, In addition to Targeting and Encrypting Windows and Linux devices, BlackCat is also capable of encrypting VMware servers. The payload was launched via dllhost.exe when the BlackCat payload did not have administrator privileges, which was the default launch method.

Following that, it launches several commands by means of cmd.exe. Depending on the environment, the BlackCat payload can be customized to execute the specific commands as required.

Here below we have mentioned all the capabilities of the BlackCat ransomware:- 

  • User account control (UAC) bypass
  • Domain and device enumeration
  • Self-propagation
  • Hampering recovery efforts

RaaS scheme

RaaS schemes make use of the variables of initial access vectors to deliver the goal of stealing and encrypting target data. These encrypted files are then held ransom as part of what is referred to as double extortion techniques.

As a result of RaaS, cybercriminal ecosystems have been transformed into lucrative gig economies using three distinct key players that are:-

  • Access brokers (IABs)
  • Operators
  • Affiliates

The other threat groups involved in the use of these ransomware families are DEV-0237 and DEV-0504, two of the most prolific and most prevalent affiliate threat groups.

Here are the ransomware families that are found to be distributing the BlackCat ransomware:-

  • Hive
  • Conti
  • REvil
  • LockBit 2.0

Here’s what Microsoft stated:-

“In the BlackCat-related incidents we’ve observed, the common entry points for ransomware affiliates were via compromised credentials to access internet-facing remote access software and unpatched Exchange servers. Therefore, defenders should review their organization’s identity posture, carefully monitor external access, and locate vulnerable Exchange servers in their environment to update as soon as possible.”

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Coinbase Data Breach – Customers Personal Info, Government‑ID & Transaction Data Exposed

Coinbase, the largest cryptocurrency exchange in the United States, has disclosed a significant cybersecurity...

Inside Turla’s Uroboros Infrastructure and Tactics Revealed

In a nation-state cyber espionage, a recent static analysis of the Uroboros rootkit, attributed...

CISA Alerts on Five Active Zero-Day Windows Vulnerabilities Being Exploited

Cybersecurity professionals and network defenders, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has...

Intruder vs. Acunetix vs. Attaxion: Comparing Vulnerability Management Solutions

The vulnerability management market is projected to reach US$24.08 billion by 2030, with numerous...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Intruder vs. Acunetix vs. Attaxion: Comparing Vulnerability Management Solutions

The vulnerability management market is projected to reach US$24.08 billion by 2030, with numerous...

TransferLoader Malware Enables Attackers to Execute Arbitrary Commands on Infected Systems

A formidable new malware loader, dubbed TransferLoader, has emerged as a significant cybersecurity threat,...

Interlock Ransomware Targeting Defense Contractors and Supply Chain Networks

The Interlock Ransomware group has emerged as a significant adversary targeting defense contractors and...