Article
FIN8 Group Uses Sardonic Backdoor for BlackCat Ransomware Attacks
FIN8, also called Syssphinx, used a modified Sardonic backdoor in BlackCat ransomware attacks. See how the backdoor works and how to reduce the risk.
Read more
Malware profile
BlackCat
Also known as ALPHV, Noberus
BlackCat is ransomware written in Rust that was offered to criminal affiliates as a ransomware-as-a-service.
In short
BlackCat is ransomware written in Rust that was offered to criminal affiliates as a ransomware-as-a-service. MITRE says it was first observed in November 2021, and it can encrypt Windows devices, Linux devices and VMware instances. In December 2023 the US Justice Department announced a disruption campaign against the group behind it.
- Names5names in public reportsBlackCat · ALPHV · Noberus
- Techniques17ATT&CK techniques listedImpact · Defense Impairment · Lateral Movement
- Infection Steps5in the delivery chainSocial engineering · Remote access and credentials
- Linked Groups1groups that use itScattered Spider
In one minute
- What it is
- Ransomware written in Rust, offered to affiliates as a ransomware-as-a-service. MITRE says it was first observed in November 2021.
- What it does
- Encrypts Windows devices, Linux devices and VMware instances. It can delete shadow copies, wipe VM snapshots, stop VM services and clear Windows event logs. Affiliates also steal data before encrypting.
- Who uses it
- Described by the US Department of Justice (19 December 2023) as run by the BlackCat group (also ALPHV, Noberus) with affiliates. MITRE lists Scattered Spider as a user.
- How it gets in
- Affiliates pose as company IT or helpdesk staff on calls or SMS to get employee credentials, according to FBI, CISA and HHS advisory AA23-353A. The Justice Department also names compromised user credentials.
- What to do first
- Compare your systems with the indicators in advisory AA23-353A, allow only approved remote access tools, and use phishing-resistant multifactor sign-in.
What it does
The US Justice Department says developers of BlackCat create and update the ransomware and run the infrastructure, while affiliates pick and attack high-value victims. After a victim pays, developers and affiliates share the ransom. Before encrypting, an affiliate steals sensitive data, then asks for payment to decrypt the system and to not publish the stolen data.
A joint FBI, CISA and HHS advisory says some affiliates steal data and demand payment without deploying ransomware at all. It also says the group announced a rewritten version, ALPHV Blackcat Ransomware 2.0 Sphynx, in February 2023.
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| BlackCat | MITRE ATT&CK software S1068, the Justice Department press release and CISA alerts[1, 3, 4] |
| ALPHV | MITRE ATT&CK Associated Software[1] |
| Noberus | MITRE ATT&CK Associated Software; also named by the Justice Department[1, 3] |
| ALPHV Blackcat | Title and text of joint advisory AA23-353A[2] |
| ALPHV Blackcat Ransomware 2.0 Sphynx | Name of the rewritten version in advisory AA23-353A[2] |
What it can do
What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Impact
Data Encrypted for Impact T1486
It can encrypt Windows devices, Linux devices and VMware instances.[1]
Inhibit System Recovery T1490
It can delete shadow copies with vssadmin.exe and wmic.exe, and can change the boot loader so recovery is turned off.[1]
Service Stop T1489
It can stop virtual machine services on a compromised network.[1]
Disk Wipe: Disk Content Wipe T1561.001
It can wipe virtual machine snapshots on a compromised network.[1]
Defacement: Internal Defacement T1491.001
It can change the desktop wallpaper on compromised hosts.[1]
Defense Impairment
Lateral Movement
Privilege Escalation
Execution
Discovery
Permission Groups Discovery: Domain Groups T1069.002
It can check whether a user on the host has domain admin privileges.[1]
Account Discovery: Domain Account T1087.002
It can use net use commands to identify domain users.[1]
Network Share Discovery T1135
It can discover network shares on compromised networks.[1]
Remote System Discovery T1018
It can broadcast NetBIOS Name Service messages to look for servers on the network.[1]
File and Directory Discovery T1083
It can list files so it knows what to encrypt.[1]
How it spreads
According to the joint FBI, CISA and HHS advisory AA23-353A, affiliates use social engineering and open source research on a company to gain initial access. They pose as company IT or helpdesk staff and use phone calls or SMS messages to get credentials from employees. The US Justice Department also says affiliates have used compromised user credentials. MITRE says BlackCat can copy itself across connected servers using psexec.
How an infection runs
The order of steps in a typical infection, as the sources describe it.
Social engineering
Affiliates pose as company IT or helpdesk staff and use phone calls or SMS messages to get employee credentials.[2]
Remote access and credentials
Inside the network they deploy remote access software, use tunneling tools and collect passwords from the domain controller, local network and backup servers to move sideways.[2]
Cleanup and data theft
Logs are cleared on the exchange server, then data is moved out with file sharing services.[2]
Ransomware deployed
The ransomware is run and a ransom note is left as a text file.[2]
Extortion
Affiliates contact victims over Tor, Tox, email or encrypted apps, and may offer unsolicited remediation advice as an incentive for payment.[2]
Timeline
- November 2021
First observed
MITRE says BlackCat was first observed in November 2021.[1]
- April 19, 2022
- February 2023
Rewritten version announced
The administrators announced the ALPHV Blackcat Ransomware 2.0 Sphynx update, rewritten to give affiliates better defense evasion and more tooling.[2]
- September 2023
More than 1,000 victims
CISA says FBI investigations, as of September 2023, put the number of compromised entities at over 1000.[5]
- Early December 2023
Operational action
The advisory refers to operational action against the group and its infrastructure in early December 2023.[2]
- December 19, 2023
Justice Department disruption
The Justice Department announced a disruption campaign, an FBI decryption tool offered to over 500 victims, and seized websites.[3]
- December 19, 2023
- February 27, 2024
Who uses it
- Ransomware group ALPHV / BlackCat ALPHV Blackcat is a ransomware as a service operation. Disrupted · Since 2021 · Ransomware as a service
- Threat group Scattered Spider Scattered Spider is described by MITRE ATT&CK and by the FBI, CISA and partner agencies as a cybercriminal group that targets large companies and their IT help desks, mainly by tricking staff into resetting passwords and MFA. Not attributed to a state · Since 2022
Seen in
Detection and defense
Control remote access tools
Use application controls to allowlist remote access programs and block portable, unapproved ones. The advisory says antivirus may miss portable executables that are compressed, encrypted or obfuscated.[2]
Use phishing-resistant MFA
The advisory recommends FIDO/WebAuthn or PKI-based MFA, which resist push bombing and SIM swap attacks used by affiliates.[2]
Train users and monitor mail
Train users on social engineering and phishing, and monitor internal mail and messaging for suspicious activity.[2]
Do the basics
The advisory lists: inventory assets, fix known exploited vulnerabilities first, enforce MFA with strong passwords, and close unused ports.[2]
If compromised
Quarantine or take offline affected hosts, reimage them, provision new account credentials and collect artifacts such as running processes and unusual authentications.[2]
Contact the FBI
The Justice Department encourages BlackCat victims to contact their local FBI field office to learn what help is available.[3]
Questions
What is BlackCat?
MITRE describes it as ransomware written in Rust, offered as a ransomware-as-a-service, first observed in November 2021. It is also named ALPHV and Noberus.
Was BlackCat disrupted by law enforcement?
The US Justice Department announced a disruption campaign on 19 December 2023. It says the FBI developed a decryption tool offered to over 500 victims and seized several websites the group operated. Its advisory later says the group and its infrastructure faced operational action in early December 2023.
How does BlackCat get into a network?
The FBI, CISA and HHS say affiliates pose as IT or helpdesk staff by phone or SMS to obtain employee credentials. The Justice Department also names compromised user credentials.
Who uses BlackCat?
Affiliates of the BlackCat group, which the Justice Department describes as running a ransomware-as-a-service. MITRE also lists Scattered Spider as a group that has deployed it.
Where are the official indicators?
In joint advisory AA23-353A from FBI, CISA and HHS, and in the FBI FLASH CU-000167-MW of April 2022. The FLASH page did not open for us, so only the CISA alert describing it was read.
In our research
- FIN8 Group Uses Sardonic Backdoor for BlackCat Ransomware Attacks July 2023
- BlackCat Ransomware Is Targeted Vulnerable Microsoft Exchange Servers June 2022
- Ransomware Trends Report | Q1 2024 April 2024
- Scattered Spider Threat group
Sources
- BlackCat, Software S1068 MITRE ATT&CKSupports: Description, first observed date, aliases, platforms, techniques and the Scattered Spider listing.
- Justice Department Disrupts Prolific ALPHV/Blackcat Ransomware Variant US Department of JusticeSupports: 19 December 2023 disruption, decryption tool, RaaS model, double extortion, victim numbers.
- FBI Releases IOCs Associated with BlackCat/ALPHV Ransomware CISASupports: FBI FLASH CU-000167-MW and at least 60 entities compromised by April 2022.
- CISA and FBI Release Advisory on ALPHV Blackcat Affiliates CISASupports: December 2023 advisory and the figure of over 1000 compromised entities.
- CISA, FBI, and HHS Release an Update to #StopRansomware Advisory on ALPHV Blackcat CISASupports: 27 February 2024 update and healthcare focus.
- Affidavit in support of search warrant, case 23-6595-HUNT US Department of Justice (Southern District of Florida filing)Supports: FBI description of affiliates, access before ransom demand, leak sites and ransom payments.
- Scattered Spider, Group G1015 MITRE ATT&CKSupports: MITRE lists Scattered Spider as having deployed BlackCat.
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.