BlackCat ransomware

This blog was jointly written with Santiago Cortes. 

Executive summary

AT&T Alien Labs™ is writing this report about recently created ransomware malware dubbed BlackCat which was used in a January 2022 campaign against two international oil companies headquartered in Germany, Oiltanking and Mabanaft. The attack had little impact on end customers, but it does serve to remind the cybersecurity community of the potential for threat actors to continue attacks against critical infrastructure globally.

Key takeaways:

• The ransomware BlackCat is coded in Rust and was created in November 2021.
• Following trends observed last year by Alien Labs, the ransomware targets multiple platforms (Windows and Linux), and it uses additional code to infect VMware’s ESXi hypervisor.
• Blackcat uses a “wall of shame” website to both blackmail victims, prove, and promote their latest campaigns publicly.
• Campaigns remain active, with 16 known incidents in February 2022 as of the publishing of this report.

Background

The 2021 ransomware attack on US-based Colonial Pipeline, which impacted the fuel supply on the East Coast of America for several days, raised awareness of the reality that adversaries are well prepared to launch future cyberattacks globally that could severely impact a country’s infrastructure. Now, with confrontations in the Ukrainian region taking on new levels of urgency, there is heightened expectation of future threat actor campaigns against the critical infrastructure of western countries. The campaigns could take the form of ransomware attacks or data wiper attacks, as these have been the highly successful in recent years, especially when combined with supply chain attacks.

Analysis

German newspaper Handelsblatt stated the oil companies Oiltanking and Mabanaft had been affected by a ransomware attack on January 29, 2022, that impacted one of the key oil providers in the area. The attacks allegedly caused Shell to re-route their supplies in order to avoid severe impacts to the German fuel supply. Even with these actions, it’s been stated that 233 gas stations across Germany have been affected by the incident, resulting in those stations having to run some processes manually and only taking cash payment.

The malware behind these attacks is known as BlackCat ransomware, aka ALPHV, as reported by the same newspaper. The group operates with a ransomware-as-a-service (RaaS) business model, where the ransomware authors are entitled to 10-20% of the ransom payment, while the rest is kept by the affiliates deploying the payload. After a successful attack, victims who refuse to pay the ransom have their details posted on dark web forums to make attacks public, increasing their notoriety and shaming the affected organizations. According to these blogs, at least 10 companies may have been impacted by these ransomware campaigns in the first two weeks of February.

Since the malware family operates as a RaaS, the initial access vector depends on the affiliate party deploying the payload and can vary from one attacker to another. However, all of them appear to attempt to exfiltrate victims’ data before starting the encryption process, gaining extortion power for subsequent requests.

The BlackCat gang first appeared in mid-November 2021, and its payload is written in the Rust programming language, which is considered to have a similar performance to C/C++, but with better memory management to avoid memory errors and concurrent programming. Additionally, it is a cross platform language, allowing developers to target several operating systems with the same code. For these reasons, it has been voted as the “most loved programming language” in Stack Overflow since 2016.

Aside from the developing advantages Rust offers, the attackers also take advantage of a lower detection ratio from static analysis tools, which aren’t usually adapted to all programming languages. For this same reason, Go Language had become more popular among malware coders during last year, as seen in other blogs released by Alien Labs, including:

• Blog TeamTNT Delivers Cryptomining Malware Using New Memory Loader
• Blog BotenaGo

Rust has been present in malware samples for many years, but BlackCat is the first professionally/commercialized distributed malware family using it, and the most prosperous thus far.

When executed, the malware offers several options for customizing its execution. These options have evolved since its first version, shown in figure 2 which compares one of the first samples available (reported by MalwareHunterTeain December 2021) to the latest samples/versions.

Figure 1. @malwrhunterteam screenshot of execution.

Most arguments are optional, but access-token is enforced to bypass the dynamic analysis performed by automated sandboxes. However, any token provided bypasses the restriction and enables malware execution. This token, in addition to the host universally unique identifier (UUID), is later used to identify the victim in a Tor website hosted by the attackers, which displays the price for the files decryptor.

Among these options, Alien Labs has observed how some of them are specific to VMware ESXi. This inclusion follows trends observed in 2021 among other popular RaaS groups, like DarkSide or REvil,  who added Linux capabilities to include VMware ESXi in their scope of potential targets. The hypervisor ESXi allows multiple virtual machines (VM) to share the same hard drive storage. However, this also enables attackers to encrypt the centralized virtual hard drives used to store data from across VMs, potentially causing disruptions to companies.

The BlackCat malware has code very similar to its predecessors. It first aims to stop any running VMs in ESXi. By doing this, the attacker ensures no other VM is handling the files to be encrypted, avoiding corruption issues of the encrypted files. Additionally, any ESXi snapshots are removed to harden recovery from the attack.

Additional preparation procedures are performed by the BlackCat malware on Windows systems. For example, it carries out some noisy activities that can be detected with Alien Labs correlation rules, as seen in Appendix A:

• Delete Volume Shadow Copies Services to harden recovery from the attack. The command used is ‘vssadmin.exe Delete Shadows /all /quiet’.
• Disables the recovery mode in BCDedit: ‘bcdedit.exe /set {default} recoveryenabled No’.
• Maximize the value of network requests the Server Service can take by changing the value in the registry to 65535. This change eludes issues accessing too many files at once during the encryption process. The command used is: ‘reg add HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesLanmanServerParameters /v MaxMpxCt /d 65535 /t REG_DWORD /f ’.
• If enabled, it attempts to propagate with psexec into different systems. The command runs from the %TEMP% folder, leveraging the credentials in the config file and the parent’s execution options for propagation options. ‘psexec.exe -accepteula {Target} -u {user} -p {password} -s -d -f -c {payload}.exe {inherited execution flags}’.
• Clears all the event logs with wevtutil with the command: ‘cmd.exe /c for /F “tokens=*” %1 in ('wevtutil.exe el') DO wevtutil.exe cl “%1″’.

In addition to the options shown in figure 1, the latest samples have added three additional functions that increase the ransomware capabilities. These changes maintain the line of work already seen, without including any major changes to the way the malware operates.

Figure 2. Latest sample executed.

The current default configuration file appended with the latest observed executable, includes among others:

• The public key
• The file extension to use for encrypted files, which corresponds to seven alphanumeric characters (0hzoagy for one of the latest samples)
• A ransom note (see figure 3) contains the victim’s name multiple times as well as the type of files BlackCat has exfiltrated
• A list of pre-obtained credentials from the victim that are to be used during execution
• A list of services the victim should kill according to the attacker, before executing the encryption process — usually services modifying files that could corrupt files or backup services that could become counter-productive to the malicious execution. The list includes: mepocs, memtas, veeam, svc$, backup, sql, vss, msexchange, sql$, mysql, mysql$, sophos, MSExchange, MSExchange$, WSBExchange, PDVFSService, BackupExecVSSProvider, BackupExecAgentAccelerator, BackupExecAgentBrowser, BackupExecDiveciMediaService, BackupExecJobEngine, BackupExecManagementService, BackupExecRPCService, GxBlr, GxVss, GxClMgrS, GxCVD, GxCIMgr, GXMMM, GxVssHWProv, GxFWD, SAPService, SAP, SAP$, SAPD$, SAPHostControl, SAPHostExec, QBCFMonitorService, QBDBMgrN, QBIDPService, AcronisAgent, VeeamNFSSvc, VeeamDeploymentService, VeeamTransportSvc, MVArmor, MVarmor64, VSNAPVSS, AcrSch2Svc.

Figure 3. Example of ransom note.

• A list of processes to be killed before executing the encryption process, with a similar target as the services list: agntsvc, dbeng50, dbsnmp, encsvc, excel, firefox, infopath, isqlplussvc, msaccess, mspub, mydesktopqos, mydesktopservice, notepad, ocautoupds, ocomm, ocssd, onenote, oracle, outlook, powerpnt, sqbcoreservice, sql, steam, synctime, tbirdconfig, thebat, thunderbird, visio, winword, wordpad, xfssvccon, *sql*, bedbh, vxmon, benetns, bengien, pvlsvr, beserver, raw_agent_svc, vsnapvss, CagService, QBIDPService, QBDBMgrN, QBCFMonitorService, SAP, TeamViewer_Service, TeamViewer, tv_w32, tv_x64, CVMountd, cvd, cvfwd, CVODS, saphostexec, saposcol, sapstartsrv, avagent, avscc, DellSystemDetect, EnterpriseClient, VeeamNFSSvc, VeeamTransportSvc, VeeamDeploymentSvc.
• A list of excluded directories, filenames and file extensions to ensure the computer is operative after the encryption.
  • Directories: system volume information, intel, $windows.~ws, application data, $recycle.bin, mozilla, $windows.~bt, public, msocache, windows, default, all users, tor browser, programdata, boot, config.msi, google, perflogs, appdata, windows.old.
  • Filenames: desktop.ini, autorun.inf, ntldr, bootsect.bak, thumbs.db, boot.ini, ntuser.dat, iconcache.db, bootfont.bin, ntuser.ini, ntuser.dat.log.
  • File extensions: themepack, nls, diagpkg, msi, lnk, exe, cab, scr, bat, drv, rtp, msp, prf, msc, ico, key, ocx, diagcab, diagcfg, pdb, wpx, hlp, icns, rom, dll, msstyles, mod, ps1, ics, hta, bin, cmd, ani, 386, lock, cur, idx, sys, com, deskthemepack, shs ,ldf, theme, mpa, nomedia, spl, cpl, adv, icl, msu.

The ransom note then points to a Tor onion domain with the field ‘access-key=’ to identify the victim and show the price to recover their files with the Decrypt App. Prices are indicated in Bitcoin and Monero, the latest has a discount over Bitcoin.

Recommended actions

1. Maintain software with the latest security updates.
2. Monitor and strongly, regularly communicate to employees to not open and report suspicious emails.
3. Use a backup system to backup server files.
4. Install Antivirus and/or endpoint detection and response on all endpoints.
5. Make sure two-factor authentication is enabled in all services.

Conclusion

Recent ransomware attacks performed on German oil suppliers were successful, but they did not have a significant impact on the country's infrastructure. However, considering geo-political events in Eastern Europe, these attacks should serve as a strong reminder that organizations must remain on high alert against cyberattacks. They should examine recent campaigns such as those run with BlackCat malware to educate  teams and maintain up-to-date detections for the latest threat actor tactics, techniques, and procedures (TTPs). Like most attacks and threat actor campaigns, BlackCat ransomware can achieve Initial Access using many different variations that are dependent on the affiliate operating the attack. However, the payload will be very similar for infections. Blue teams can use this technical information to improve their readiness against the latest RaaS attacks.

Alien Labs will continue to monitor variations of BlackCat malware and will update any activities on the Alien Labs Open Threat Exchange™, which is a free, global open threat intelligence community with more than 200,000 users publishing updated threat intelligence daily. We deliver this information in the form of “pulses” that can be shared publicly and privately. In addition, members of OTX can download millions of indicators of compromise (IOCs), including those associated with BlackCat through integration with the platform.

Alien Labs is tracking IOCs associated with the geo-political conflict in Eastern Europe, through tagged pulses that track incident and related threat intelligence. To get the most updated information join OTX and visit this URL to see the full list of pulses associated with potential campaigns that may be related to the Ukranian/Russian conflict and threat actors targeting other countries.   

Appendix A. Detection methods

The following associated detection methods are in use by Alien Labs. They can be used by readers to tune or deploy detections in their own environments or for aiding additional research.

USM Anywhere Correlation Rules

Removed all snapshots using vimcmd

Windows Shadow Copies Deletion

Windows PSExec Usage

Windows PSExec Service Usage

Windows SMB Server Maximum Concurrent Requests Set To Maximum Value

Windows Event Log Removed with wevtutil

Suspicious Bcdedit Usage

 

YARA RULES

rule BlackCat : WindowsMalware { meta: author = “AlienLabs” description = “Detects BlackCat payloads.” SHA256 = “6660d0e87a142ab1bde4521d9c6f5e148490b05a57c71122e28280b35452e896″ strings: $rust = “/rust/” ascii wide $a0 = “vssadmin.exe Delete Shadows /all /quietshadow” ascii $a1 = “bcdedit /set {default}bcdedit /set {default} recoveryenabled No” ascii wide $a2 = “ServicesLanmanServerParameters /v MaxMpxCt /d 65535” ascii wide $a3 = “.onion/?access-key=${ACCESS_KEY}” ascii wide $b0 = “config_id” ascii $b1 = “public_key” ascii $b2 = “extension” ascii $b3 = “note_file_name” ascii $b4 = “enable_esxi_vm_kill” ascii $b5 = “enable_esxi_vm_snapshot_kill” ascii condition: uint16(0) == 0x5A4D and filesize < 5MB and $rust and 2 of ($a*) and 3 of ($b*) }

rule LinuxBlackCat : LinuxMalware { meta: author = “AlienLabs” description = “Detects BlackCat payloads.” SHA256 = “5121f08cf8614a65d7a86c2f462c0694c132e2877a7f54ab7fcefd7ee5235a42″ strings: $rust = “/rust/” ascii wide $a0 = “esxcli vm process kill –type=force –world-id=” ascii wide $a1 = “.onion/?access-key=${ACCESS_KEY}” ascii wide $b0 = “config_id” ascii $b1 = “public_key” ascii $b2 = “extension” ascii $b3 = “note_file_name” ascii $b4 = “enable_esxi_vm_kill” ascii $b5 = “enable_esxi_vm_snapshot_kill” ascii condition: uint32(0) == 0x464c457f and filesize < 5MB and $rust and all of ($a*) and 3 of ($b*) }

Appendix B. Associated indicators (IOCs)

The following technical indicators are associated with the reported intelligence. A list of indicators is also available in the OTX Pulse. Please note, the pulse may include other activities related but out of the scope of the report.

TYPE	INDICATOR	DESCRIPTION
SHA256	f2b3f1ed693021b20f456a058b86b08abfc4876c7a3ae18aea6e95567fd55b2e	Windows BlackCat Payload
SHA256	cefea76dfdbb48cfe1a3db2c8df34e898e29bec9b2c13e79ef40655c637833ae	Windows BlackCat Payload
SHA256	7e363b5f1ba373782261713fa99e8bbc35ddda97e48799c4eb28f17989da8d8e	Windows BlackCat Payload
SHA256	f837f1cd60e9941aa60f7be50a8f2aaaac380f560db8ee001408f35c1b7a97cb	Windows BlackCat Payload
SHA256	731adcf2d7fb61a8335e23dbee2436249e5d5753977ec465754c6b699e9bf161	Windows BlackCat Payload
SHA256	7b2449bb8be1b37a9d580c2592a67a759a3116fe640041d0f36dc93ca3db4487	Windows BlackCat Payload
SHA256	38834b796ed025563774167716a477e9217d45e47def20facb027325f2a790d1	Windows BlackCat Payload
SHA256	40f57275721bd74cc59c0c59c9f98c8e0d1742b7ae86a46e83e985cc4039c3a5	Windows BlackCat Payload
SHA256	b588823eb5c65f36d067d496881d9c704d3ba57100c273656a56a43215f35442	Windows BlackCat Payload
SHA256	f815f5d6c85bcbc1ec071dd39532a20f5ce910989552d980d1d4346f57b75f89	Windows BlackCat Payload
SHA256	0c6f444c6940a3688ffc6f8b9d5774c032e3551ebbccb64e4280ae7fc1fac479	Windows BlackCat Payload
SHA256	c5ad3534e1c939661b71f56144d19ff36e9ea365fdb47e4f8e2d267c39376486	Windows BlackCat Payload
SHA256	7154fdb1ef9044da59fcfdbdd1ed9abc1a594cacb41a0aeddb5cd9fdaeea5ea8	Windows BlackCat Payload
SHA256	658e07739ad0137bceb910a351ce3fe4913f6fcc3f63e6ff2eb726e45f29e582	Windows BlackCat Payload
SHA256	5bdc0fb5cfbd42de726aacc40eddca034b5fa4afcc88ddfb40a3d9ae18672898	Windows BlackCat Payload
SHA256	c8b3b67ea4d7625f8b37ba59eed5c9406b3ef04b7a19b97e5dd5dab1bd59f283	Windows BlackCat Payload
SHA256	bd337d4e83ab1c2cacb43e4569f977d188f1bb7c7a077026304bf186d49d4117	Windows BlackCat Payload
SHA256	28d7e6fe31dc00f82cb032ba29aad6429837ba5efb83c2ce4d31d565896e1169	Windows BlackCat Payload
SHA256	15b57c1b68cd6ce3c161042e0f3be9f32d78151fe95461eedc59a79fc222c7ed	Windows BlackCat Payload
SHA256	4e18f9293a6a72d5d42dad179b532407f45663098f959ea552ae43dbb9725cbf	Windows BlackCat Payload
SHA256	13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31	Windows BlackCat Payload
SHA256	c3e5d4e62ae4eca2bfca22f8f3c8cbec12757f78107e91e85404611548e06e40	Windows BlackCat Payload
SHA256	1af1ca666e48afc933e2eda0ae1d6e88ebd23d27c54fd1d882161fd8c70b678e	Windows BlackCat Payload
SHA256	3d7cf20ca6476e14e0a026f9bdd8ff1f26995cdc5854c3adb41a6135ef11ba83	Windows BlackCat Payload
SHA256	722f1c1527b2c788746fec4dd1af70b0c703644336909735f8f23f6ef265784b	Windows BlackCat Payload
SHA256	d767524e1bbb8d50129485ffa667eb1d379c745c30d4588672636998c20f857f	Windows BlackCat Payload
SHA256	aae77d41eba652683f3ae114fadec279d5759052d2d774f149f3055bf40c4c14	Windows BlackCat Payload
SHA256	be8c5d07ab6e39db28c40db20a32f47a97b7ec9f26c9003f9101a154a5a98486	Windows BlackCat Payload
SHA256	9f6876762614e407d0ee6005f165dd4bbd12cb21986abc4a3a5c7dc6271fcdc3	Windows BlackCat Payload
SHA256	79802d6a6be8433720857d2b53b46f8011ec734a237aae1c3c1fea50ff683c13	Windows BlackCat Payload
SHA256	2cf54942e8cf0ef6296deaa7975618dadff0c32535295d3f0d5f577552229ffc	Windows BlackCat Payload
SHA256	bacedbb23254934b736a9daf6de52620c9250a49686d519ceaf0a8d25da0a97f	Windows BlackCat Payload
SHA256	3c8ad2dae0b1bb536925b4e8d5a87e77c6134371eada2c7628358d6c6d3083dc	Windows BlackCat Payload
SHA256	67d1f4077e929385cfd869bf279892bf10a2c8f0af4119e4bc15a2add9461fec	Windows BlackCat Payload
SHA256	5a604a8f0e72f3bf7901b7b67f881031a402ab8072269c00233a554df548f54d	Windows BlackCat Payload
SHA256	6660d0e87a142ab1bde4521d9c6f5e148490b05a57c71122e28280b35452e896	Windows BlackCat Payload
SHA256	f8c08d00ff6e8c6adb1a93cd133b19302d0b651afd73ccb54e3b6ac6c60d99c6	Linux BlackCat Payload
SHA256	5121f08cf8614a65d7a86c2f462c0694c132e2877a7f54ab7fcefd7ee5235a42	Linux BlackCat Payload
SHA256	3a08e3bfec2db5dbece359ac9662e65361a8625a0122e68b56cd5ef3aedf8ce1	Linux BlackCat Payload
SHA256	f7a038f9b91c40e9d67f4168997d7d8c12c2d27cd9e36c413dd021796a24e083	Linux BlackCat Payload
SHA256	9802a1e8fb425ac3a7c0a7fca5a17cfcb7f3f5f0962deb29e3982f0bece95e26	Linux BlackCat Payload

 

Appendix C. Mapped to MITRE ATT&CK

The findings of this report are mapped to the following MITRE ATT&CK Matrix techniques:

• TA0005: Defense Evasion
  • T1070: Indicator Removal on Host
    • T1070.001: Clear Windows Event Logs
  • T1078: Valid Accounts
    • T1078.003: Local Accounts
  • T1562: Impair Defenses
    • T1562.001: Disable or Modify Tools
• TA0010: Exfiltration
  • T1048: Exfiltration Over Alternative Protocol
    • T1048.002: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
• TA0040: Impact
  • T1486: Data Encrypted for Impact

Appendix D. Reporting context

The following list of sources was used by the report author(s) during the collection and analysis process associated with this intelligence report.

1. https://ift.tt/y0chBaC
2. https://ift.tt/N0wYaiZ

Alien Labs rates sources based on the Intelligence source and information reliability rating system to assess the reliability of the source and the assessed level of confidence we place on the information distributed. The following chart contains the range of possibilities, and the selection applied to this report..

Source reliability A1

RATING	DESCRIPTION
A – Reliable	No doubt about the source's authenticity, trustworthiness, or competency. History of complete reliability.
B – Usually Reliable	Minor doubts. History of mostly valid information.
C – Fairly Reliable	Doubts. Provided valid information in the past.
D – Not Usually Reliable	Significant doubts. Provided valid information in the past.
E – Unreliable	Lacks authenticity, trustworthiness, and competency. History of invalid information.
F – Reliability Unknown	Insufficient information to evaluate reliability. May or may not be reliable.

 

Information reliability A2

RATING	DESCRIPTION
1 – Confirmed	Logical, consistent with other relevant information, confirmed by independent sources.
2 – Probably True	Logical, consistent with other relevant information, not confirmed.
3 – Possibly True	Reasonably logical, agrees with some relevant information, not confirmed.
4 – Doubtfully True	Not logical but possible, no other information on the subject, not confirmed.
5 – Improbable	Not logical, contradicted by other relevant information.
6 – Cannot be judged	The validity of the information can not be determined.

Feedback

AT&T Alien Labs welcomes feedback about the reported intelligence and delivery process. Please contact the Alien Labs report author or contact labs@alienvault.com.

The post BlackCat ransomware appeared first on Cybersecurity Insiders.

February 26, 2022 at 09:09AM

Posted in: Cyber Security, Cybersecurity Insiders, Hacking, Hacking Articles, Hacking News, Security