Researchers Unvield the Sophisticated Ransomware Used by Black Hunt

The Black Hunt ransomware has recently become a significant threat to the cybersecurity landscape. This malicious software has already wreaked havoc on around 300 companies in Paraguay, causing significant damage and disruption to their operations.

The impact of this ransomware attack is likely to be far-reaching, affecting not only the affected companies but also their customers, employees, and other stakeholders.

In the year 2022, security researchers have identified a new form of ransomware known as Black Hunt.

This malicious software is specifically designed to target and compromise different types of operating systems, putting the data and privacy of countless users at risk.

The notorious Black Hunt ransomware is known for using advanced file encryption techniques to restrict access to the victim’s data.

This malicious software also goes a step further and alters the filenames of the affected files, making it difficult for the victim to identify and recover their data.

As per Rapid7’s analysis, it has been discovered that Black Hunt shares certain similarities with Lockbit, among other technical details.

Run Free ThreatScan on Your Mailbox

AI-Powered Protection for Business Email Security

Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Try Trustifi Free Threat Scan with Sophisticated AI-Powered Email Protection .

Run Free Threat Scan

How the Ransomware Works

This malicious software is suspected to have been developed using leaked code from the LockBit ransomware and has several similarities to the infamous REvil ransomware.

Black Hunt encrypts files on the infected system and demands a ransom payment in exchange for the decryption key.

The emergence of this new ransomware variant highlights the ongoing threat posed by cybercriminals and emphasizes the need for robust cybersecurity practices to protect against such attacks.

It checks for a specific file, “Vaccine.txt,” under the directory C:\ProgramData path to determine if the system has already been compromised.

This particular strain of ransomware has the ability to conceal its window from the user’s view and modify its privileges to operate in a covert manner.

Additionally, it has the capability to accept command-line arguments, which allows for further customization of its behavior.

The operation known as Black Hunt appears to have a predetermined list of countries that it targets, and it also seems to have a whitelist of languages that it can use for execution.

The process involves the creation of entries in the computer’s registry to ensure that the malware remains active even after rebooting the system.

Additionally, the malware modifies the Windows settings to disable crucial security features, leaving the system vulnerable to further attacks.

The ransomware uses the file extension “.Hunt2” to encrypt files and also deletes shadow copies.

The malicious software strives to propagate itself to other computers on the network by exploiting vulnerabilities in shared folders and files. In addition, it utilizes a range of techniques to avoid detection by security measures.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.