Sophos reveals latest tactics of BlackCat ransomware group
Sophos has revealed that the ransomware gang BlackCat has added Brute Ratel, a pentesting tool, to its arsenal of attack tools.
The article titled 'BlackCat Ransomware Attacks Not Merely a Byproduct of Bad Luck' details a string of ransomware attacks in which BlackCat used unpatched or outdated firewalls and VPN services to infiltrate vulnerable networks and systems worldwide across various industries.
BlackCat ransomware first emerged in November 2021 as the self-declared newest leader in the ransomware-as-a-service business, and quickly drew attention for its unusual coding language, Rust.
As soon as December 2021, targeted organisations called in Sophos Rapid Response to investigate at least five attacks involving BlackCat.
In four of these incidents, the initial infection occurred by exploiting vulnerabilities in different firewall vendors products. One of these vulnerabilities was from 2018 and another emerged last year.
Once inside the network, the attackers were able to obtain VPN credentials stored on these firewalls to log in as authorised users and then move laterally throughout the systems using remote desktop protocol (RDP).
As seen in prior BlackCat incidents, the attackers also leveraged open source and commercially available tools to create additional backdoors and alternative pathways for remote access to targeted systems. These included TeamViewer, nGrok, Cobalt Strike and Brute Ratel.
Christopher Budd, senior manager, threat research, Sophos, says, "What we're seeing with BlackCat and other attacks recently is that threat actors are very efficient and effective in their work.
"They use tried and true methods, like attacking vulnerable firewalls and VPNs, because they know these still work. But they show innovation to avoid security defences, like switching to the newer post-exploitation C2 framework Brute Ratel in their attacks."
According to Sophos, there was no clear pattern to the attacks. They occurred across the U.S., Europe, and Asia at large corporations operating in different industry segments.
However, the targeted companies did share certain environmental vulnerabilities that simplified the attackers work, including outdated systems that could no longer be updated with the latest security patches, a lack of multifactor authentication for VPNs, and flat networks (where every machine can see every other machine in the network).
The common denominator with all these attacks is that they were easy to carry out. In one instance, the same BlackCat attackers installed cryptominers a month before launching the ransomware, Sophos states.
The company states, this latest research highlights how important it is to follow established best security practices; they still have a lot of power to prevent and thwart attacks, including multiple attacks against a single network.
Sophos is a worldwide specialist in next-generation cybersecurity, protecting more than 500,000 organisations and millions of consumers in more than 150 countries from advanced cyber threats.
Powered by threat intelligence, AI and machine learning from SophosLabs and SophosAI, Sophos delivers a broad portfolio of advanced products and services to secure users, networks and endpoints against ransomware, malware, exploits, phishing and the wide range of other cyber attacks.
Sophos provides a single integrated cloud-based management console, Sophos Central, as the centrepiece of an adaptive cybersecurity ecosystem that features a centralised data lake that leverages a set of open APIs available to customers, partners, developers, and other cybersecurity vendors.
