Categories: RansomwareWhat is

Beware!! BlackCat Ransomware Gang Attack Unpatched Microsoft Exchange Servers

In a recent Microsoft advisory, the company warned that the operators of BlackCat ransomware (aka ALPHV) is using exploits to gain access to target networks by exploiting unpatched Exchange server vulnerabilities.

Threat actors can exploit the compromised Exchange servers in order to perform the following actions:-

  • Access the target networks
  • Conduct internal reconnaissance
  • Lateral movement activities
  • Steal sensitive files and documents

Since March 2022, 60 organizations worldwide have been compromised by the BlackCat ransomware, as reported by the FBI in April. It is the first ransomware designed in Rust, a modern programming language that is mainly used by threat actors to build ransomware programs, in particular.

BlackCat’s Payload capabilities

According to the Microsoft report, In addition to Targeting and Encrypting Windows and Linux devices, BlackCat is also capable of encrypting VMware servers. The payload was launched via dllhost.exe when the BlackCat payload did not have administrator privileges, which was the default launch method.

Following that, it launches several commands by means of cmd.exe. Depending on the environment, the BlackCat payload can be customized to execute the specific commands as required.

Here below we have mentioned all the capabilities of the BlackCat ransomware:- 

  • User account control (UAC) bypass
  • Domain and device enumeration
  • Self-propagation
  • Hampering recovery efforts

RaaS scheme

RaaS schemes make use of the variables of initial access vectors to deliver the goal of stealing and encrypting target data. These encrypted files are then held ransom as part of what is referred to as double extortion techniques.

As a result of RaaS, cybercriminal ecosystems have been transformed into lucrative gig economies using three distinct key players that are:-

  • Access brokers (IABs)
  • Operators
  • Affiliates

The other threat groups involved in the use of these ransomware families are DEV-0237 and DEV-0504, two of the most prolific and most prevalent affiliate threat groups.

Here are the ransomware families that are found to be distributing the BlackCat ransomware:-

  • Hive
  • Conti
  • REvil
  • LockBit 2.0

Here’s what Microsoft stated:-

“In the BlackCat-related incidents we’ve observed, the common entry points for ransomware affiliates were via compromised credentials to access internet-facing remote access software and unpatched Exchange servers. Therefore, defenders should review their organization’s identity posture, carefully monitor external access, and locate vulnerable Exchange servers in their environment to update as soon as possible.”

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS devices.…

1 day ago

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch Experts…

3 days ago

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan exploits…

3 days ago

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on organizations…

3 days ago

Google Chrome Security, Critical Vulnerabilities Patched

Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to millions…

4 days ago

Notorious WrnRAT Delivered Mimic As Gambling Games

WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling games…

4 days ago