Forest Global Training Partners

Cyber Risks · Cisco Talos

What’s the point of press releases from threat actors?

Summary: ALPHV (aka BlackCat) publicly took credit for a cyber attack that took down slot machines and guest reservation systems at MGM, and posted a press release on its leak site blaming MGM for not using the actor's official communication channels to negotiate a ransom payment. The statement also said that if personally identifiable information had been stolen, ALPHV would allow Have I Been Pwned? to responsibly disclose it, and claimed news outlets reported false information or attributed the attack too early. Talos separately reported a new malware family called HTTPSnoop, a backdoor that interfaces with Windows HTTP kernel drivers to listen for requests to specific HTTP(S) URLs and execute content on infected endpoints, along with a sister implant called PipeSnoop that accepts arbitrary shellcode from a named pipe, both linked to a group called ShroudedSnooper and deployed against telecommunications providers in the Middle East.

What you should know: A ransomware crew now runs its own PR to pressure a victim into negotiating and to contest attribution to Scattered Spider, which means the public narrative around an incident is another surface an attacker will try to control. Meanwhile ShroudedSnooper's HTTPSnoop and PipeSnoop leave a backdoor for future attacks, and Talos notes the group is new and relatively unknown, so it may not stay confined to telecom.

Read the original at Cisco Talos ↗

Topics
Threat Actors & Nation-State
Related