BlackCat Climbs the Summit With a New Tactic
Summary: Unit 42 researchers obtained a copy of Munchkin, a BlackCat utility delivered as an ISO file loaded into a VirtualBox instance running a customized Alpine OS, which propagates the BlackCat payload to remote machines and encrypts remote SMB/CIFS shares. The controller malware, written in Rust, decrypts strings via single-byte XOR, parses an /app/config file, and generates customized BlackCat samples from a payload template before powering the VM off.
What you should know: Running the malware inside an embedded VM bypasses host antivirus and other controls that have no introspection into the guest OS, and BlackCat affiliates keep roughly 80-90% of each ransom payment, so the tooling incentive is direct.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026