From Black Matter to BlackCat: Analyzing two attacks from one affiliate
Summary: Cisco Talos found the same command-and-control domain and overlapping tools, file names and techniques in a December 2021 BlackCat ransomware attack and a September 2021 BlackMatter attack, assessing with moderate confidence that one affiliate carried out both. The affiliate used reverse-ssh tunnels in the BlackCat attack and GOST in the BlackMatter attack, both pointing at the same C2 server, and disabled logging with wevtutil while dumping LSASS memory via Procdump and Dumpert.
What you should know: A single affiliate moving from BlackMatter to BlackCat within BlackCat's first month of operation means your detection rules and blocklists built around one ransomware family will not carry over to the next, even when the same hands are on the keyboard.
Read the original at Cisco Talos ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·