Monday, May 5, 2025
HomeCyber Security NewsResearchers Unvield the Sophisticated Ransomware Used by Black Hunt

Researchers Unvield the Sophisticated Ransomware Used by Black Hunt

Published on

SIEM as a Service

Follow Us on Google News

The Black Hunt ransomware has recently become a significant threat to the cybersecurity landscape. This malicious software has already wreaked havoc on around 300 companies in Paraguay, causing significant damage and disruption to their operations.

The impact of this ransomware attack is likely to be far-reaching, affecting not only the affected companies but also their customers, employees, and other stakeholders.

In the year 2022, security researchers have identified a new form of ransomware known as Black Hunt.

- Advertisement - Google News

This malicious software is specifically designed to target and compromise different types of operating systems, putting the data and privacy of countless users at risk.

The notorious Black Hunt ransomware is known for using advanced file encryption techniques to restrict access to the victim’s data.

This malicious software also goes a step further and alters the filenames of the affected files, making it difficult for the victim to identify and recover their data.

As per Rapid7’s analysis, it has been discovered that Black Hunt shares certain similarities with Lockbit, among other technical details.

Document
Run Free ThreatScan on Your Mailbox

AI-Powered Protection for Business Email Security

Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Try Trustifi Free Threat Scan with Sophisticated AI-Powered Email Protection .

How the Ransomware Works

This malicious software is suspected to have been developed using leaked code from the LockBit ransomware and has several similarities to the infamous REvil ransomware.

Black Hunt encrypts files on the infected system and demands a ransom payment in exchange for the decryption key.

The emergence of this new ransomware variant highlights the ongoing threat posed by cybercriminals and emphasizes the need for robust cybersecurity practices to protect against such attacks.

It checks for a specific file, “Vaccine.txt,” under the directory C:\ProgramData path to determine if the system has already been compromised.

This particular strain of ransomware has the ability to conceal its window from the user’s view and modify its privileges to operate in a covert manner.

Additionally, it has the capability to accept command-line arguments, which allows for further customization of its behavior.

The operation known as Black Hunt appears to have a predetermined list of countries that it targets, and it also seems to have a whitelist of languages that it can use for execution.

The process involves the creation of entries in the computer’s registry to ensure that the malware remains active even after rebooting the system.

Additionally, the malware modifies the Windows settings to disable crucial security features, leaving the system vulnerable to further attacks.

The ransomware uses the file extension “.Hunt2” to encrypt files and also deletes shadow copies.

Black Hunt Ransomware Attack
Ransom note

The malicious software strives to propagate itself to other computers on the network by exploiting vulnerabilities in shared folders and files. In addition, it utilizes a range of techniques to avoid detection by security measures.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Hackers Exploit Email Fields to Launch XSS and SSRF Attacks

Cybersecurity researchers are raising alarms as hackers increasingly weaponize email input fields to execute cross-site...

Luna Moth Hackers Use Fake Helpdesk Domains to Target Victims

A recent investigation by cybersecurity firm EclecticIQ, in collaboration with threat hunters, has exposed...

SonicBoom Attack Chain Lets Hackers Bypass Login and Gain Admin Control

Cybersecurity researchers have uncovered a dangerous new exploitation technique, dubbed the "SonicBoom Attack Chain,"...

Researcher Uses Copilot with WinDbg to Simplify Windows Crash Dump Analysis

A researcher has unveiled a novel integration between AI-powered Copilot and Microsoft's WinDbg, dramatically...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Hackers Exploit Email Fields to Launch XSS and SSRF Attacks

Cybersecurity researchers are raising alarms as hackers increasingly weaponize email input fields to execute cross-site...

Luna Moth Hackers Use Fake Helpdesk Domains to Target Victims

A recent investigation by cybersecurity firm EclecticIQ, in collaboration with threat hunters, has exposed...

SonicBoom Attack Chain Lets Hackers Bypass Login and Gain Admin Control

Cybersecurity researchers have uncovered a dangerous new exploitation technique, dubbed the "SonicBoom Attack Chain,"...