Log in Request a demo

Security News

BlackCat Ransomware Is Targeted Vulnerable Microsoft Exchange Servers

Cyber threat actors have been found to launch attack campaigns by exploiting vulnerable Microsoft Exchange servers to spread BlackCat ransomware.

Brandefense logo Updated 2 Min Read
blackcat ransomware

BlackCat ransomware, also known as ALPHV, is a Rust-based ransomware-as-a-service first observed in 2021. Threat actors have used vulnerable Microsoft Exchange servers to get in, then spread it with the PsExec tool and run double extortion. This post covers how it spreads, who operates it, the Exchange flaws it names and how to reduce the risk.

How Does BlackCat Ransomware Spread Through Exchange Servers?

Cyber threat actors have been found to launch attack campaigns by exploiting vulnerable Microsoft Exchange servers to spread BlackCat ransomware. After gaining access to vulnerable Microsoft Exchange servers, BlackCat ransomware was found to be distributed to target systems with the PsExec tool. In this way, threat actors infiltrate target systems, obtain critical identity data of users and carry out “double extortion” activities. Double Extortion is the name given to cases where threat actors threaten to leak data or publish some of it on the Internet, even if the ransom is paid in ransomware-infected organizations.

Who Operates BlackCat Ransomware?

BlackCat ransomware was first observed in 2021 and developed with the Rust programming language. RaaS (Ransomware-as-a-Service) operators aim to ensure persistence by gaining unauthorized access to multiple systems on the target network before ransomware activities. How BlackCat ransomware infects victims differ according to the techniques and tactics of RaaS operators. For example, The FIN12 threat group, which organizes ransomware campaigns such as Ryuk, Hive, and Conti, is reported to have been one of the BlackCat operators since March 2022. BlackCat ransomware is also reported to be distributed by the DEV-0504 threat group, which uses the Stealbit malware of the LockBit threat group. The DEV-0504 threat group is known to use BlackMatter, Conti, LockBit 2.0, Revil, and Ryuk ransomware.

Which Microsoft Exchange Vulnerabilities Are Involved?

The Microsoft Exchange Server vulnerabilities reported in connection with this campaign are as follows;

The first flaw in that list has its own page: ProxyLogon (CVE-2021-26855).

How Can You Protect Against BlackCat Ransomware?

Using ransomware with different versions in attack campaigns significantly increases the risk of institutions and organizations encountering BlackCat-like malware. In this context, in order not to be the target of similar ransomware attacks;

  • Beware of untrusted e-mail content,
  • Not opening additional files/links of suspicious sender mail addresses,
  • Using reliable Anti-Malware solutions
  • Using licensed and current technologies,
  • It is recommended to block shared IoC findings related to the malware campaign by security solutions.

Frequently Asked Questions.

What is BlackCat ransomware?

BlackCat, also called ALPHV, is ransomware written in Rust and sold as ransomware-as-a-service. MITRE ATT&CK says it was first observed in November 2021.

How does BlackCat ransomware use Microsoft Exchange servers?

According to the post, attackers exploit vulnerable Exchange servers to gain access, then distribute the ransomware with PsExec.

What is double extortion in ransomware attacks?

It is when attackers steal data and threaten to publish it, even if the ransom is paid. The post describes BlackCat attacks as carrying out this activity.

Which Exchange vulnerabilities does the post name?

The post lists CVE-2021-26855, CVE-2021-26858, CVE-2021-26857 and CVE-2021-27065 in connection with the campaign. CISA describes them as flaws in on-premises Exchange Server 2013, 2016 and 2019.

Sources

  1. 1 MITRE ATT&CK: BlackCat (S1068)
  2. 2 CISA: #StopRansomware: ALPHV Blackcat (AA23-353A)
  3. 3 CISA: Mitigate Microsoft Exchange Server Vulnerabilities (AA21-062A)
#Blackcat #blackcat ransomware #Microsoft
Share

In This Article

Ransomware groupsALPHV / BlackCat Ransomware groupsLockBit Ransomware groupsDarkSide Malware and toolsBlackCat TermsThreat actor TermsDouble extortion TermsPersistence TermsRansomware

Where To Next.

All Security News Articles
Related · Malware BlackCat

BlackCat is ransomware written in Rust that was offered to criminal affiliates as a ransomware-as-a-service.

Open → Keep reading · Article OneDrive and SharePoint Cloud Solutions Vulnerable to Ransomware Attacks

OneDrive ransomware can encrypt SharePoint files beyond the versioning limit so they cannot be recovered.

Open → Keep reading · Article Misconfigured Elasticsearch Servers Targeted by Threat Actors

Threat actors delete the contents of misconfigured Elasticsearch servers and leave ransom notes.

Open →
Next in the Microsoft file · 7 of 9Microsoft Security Slip-ups Allow Chinese Hackers Access to US Official Emails Continue →

Knowledge HubRansomware groups Blackcatblackcat ransomwareMicrosoft