BlackCat ransomware

This blog was jointly written with Santiago Cortes. 

Executive summary

AT&T Alien Labs™ is writing this report about recently created ransomware malware dubbed BlackCat which was used in a January 2022 campaign against two international oil companies headquartered in Germany, Oiltanking and Mabanaft. The attack had little impact on end customers, but it does serve to remind the cybersecurity community of the potential for threat actors to continue attacks against critical infrastructure globally.

Key takeaways:

• The ransomware BlackCat is coded in Rust and was created in November 2021.
• Following trends observed last year by Alien Labs, the ransomware targets multiple platforms (Windows and Linux), and it uses additional code to infect VMware’s ESXi hypervisor.
• Blackcat uses a “wall of shame” website to both blackmail victims, prove, and promote their latest campaigns publicly.
• Campaigns remain active, with 16 known incidents in February 2022 as of the publishing of this report.

Background

The 2021 ransomware attack on US-based Colonial Pipeline, which impacted the fuel supply on the East Coast of America for several days, raised awareness of the reality that adversaries are well prepared to launch future cyberattacks globally that could severely impact a country’s infrastructure. Now, with confrontations in the Ukrainian region taking on new levels of urgency, there is heightened expectation of future threat actor campaigns against the critical infrastructure of western countries. The campaigns could take the form of ransomware attacks or data wiper attacks, as these have been the highly successful in recent years, especially when combined with supply chain attacks.

Analysis

German newspaper Handelsblatt stated the oil companies Oiltanking and Mabanaft had been affected by a ransomware attack on January 29, 2022, that impacted one of the key oil providers in the area. The attacks allegedly caused Shell to re-route their supplies in order to avoid severe impacts to the German fuel supply. Even with these actions, it’s been stated that 233 gas stations across Germany have been affected by the incident, resulting in those stations having to run some processes manually and only taking cash payment.

The malware behind these attacks is known as BlackCat ransomware, aka ALPHV, as reported by the same newspaper. The group operates with a ransomware-as-a-service (RaaS) business model, where the ransomware authors are entitled to 10-20% of the ransom payment, while the rest is kept by the affiliates deploying the payload. After a successful attack, victims who refuse to pay the ransom have their details posted on dark web forums to make attacks public, increasing their notoriety and shaming the affected organizations. According to these blogs, at least 10 companies may have been impacted by these ransomware campaigns in the first two weeks of February.

Since the malware family operates as a RaaS, the initial access vector depends on the affiliate party deploying the payload and can vary from one attacker to another. However, all of them appear to attempt to exfiltrate victims’ data before starting the encryption process, gaining extortion power for subsequent requests.

The BlackCat gang first appeared in mid-November 2021, and its payload is written in the Rust programming language, which is considered to have a similar performance to C/C++, but with better memory management to avoid memory errors and concurrent programming. Additionally, it is a cross platform language, allowing developers to target several operating systems with the same code. For these reasons, it has been voted as the “most loved programming language” in Stack Overflow since 2016.

Aside from the developing advantages Rust offers, the attackers also take advantage of a lower detection ratio from static analysis tools, which aren’t usually adapted to all programming languages. For this same reason, Go Language had become more popular among malware coders during last year, as seen in other blogs released by Alien Labs, including:

• Blog TeamTNT Delivers Cryptomining Malware Using New Memory Loader
• Blog BotenaGo

Rust has been present in malware samples for many years, but BlackCat is the first professionally/commercialized distributed malware family using it, and the most prosperous thus far.

When executed, the malware offers several options for customizing its execution. These options have evolved since its first version, shown in figure 2 which compares one of the first samples available (reported by MalwareHunterTeain December 2021) to the latest samples/versions.

Figure 1. @malwrhunterteam screenshot of execution.

Most arguments are optional, but access-token is enforced to bypass the dynamic analysis performed by automated sandboxes. However, any token provided bypasses the restriction and enables malware execution. This token, in addition to the host universally unique identifier (UUID), is later used to identify the victim in a Tor website hosted by the attackers, which displays the price for the files decryptor.

Among these options, Alien Labs has observed how some of them are specific to VMware ESXi. This inclusion follows trends observed in 2021 among other popular RaaS groups, like DarkSide or REvil,  who added Linux capabilities to include VMware ESXi in their scope of potential targets. The hypervisor ESXi allows multiple virtual machines (VM) to share the same hard drive storage. However, this also enables attackers to encrypt the centralized virtual hard drives used to store data from across VMs, potentially causing disruptions to companies.

The BlackCat malware has code very similar to its predecessors. It first aims to stop any running VMs in ESXi. By doing this, the attacker ensures no other VM is handling the files to be encrypted, avoiding corruption issues of the encrypted files. Additionally, any ESXi snapshots are removed to harden recovery from the attack.

Additional preparation procedures are performed by the BlackCat malware on Windows systems. For example, it carries out some noisy activities that can be detected with Alien Labs correlation rules, as seen in Appendix A:

• Delete Volume Shadow Copies Services to harden recovery from the attack. The command used is ‘vssadmin.exe Delete Shadows /all /quiet’.
• Disables the recovery mode in BCDedit: ‘bcdedit.exe /set {default} recoveryenabled No’.
• Maximize the value of network requests the Server Service can take by changing the value in the registry to 65535. This change eludes issues accessing too many files at once during the encryption process. The command used is: ‘reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f ’.
• If enabled, it attempts to propagate with psexec into different systems. The command runs from the %TEMP% folder, leveraging the credentials in the config file and the parent’s execution options for propagation options. ‘psexec.exe -accepteula \\{Target} -u {user} -p {password} -s -d -f -c {payload}.exe {inherited execution flags}’.
• Clears all the event logs with wevtutil with the command: ‘cmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"’.

In addition to the options shown in figure 1, the latest samples have added three additional functions that increase the ransomware capabilities. These changes maintain the line of work already seen, without including any major changes to the way the malware operates.

Figure 2. Latest sample executed.

The current default configuration file appended with the latest observed executable, includes among others:

• The public key
• The file extension to use for encrypted files, which corresponds to seven alphanumeric characters (0hzoagy for one of the latest samples)
• A ransom note (see figure 3) contains the victim’s name multiple times as well as the type of files BlackCat has exfiltrated
• A list of pre-obtained credentials from the victim that are to be used during execution
• A list of services the victim should kill according to the attacker, before executing the encryption process — usually services modifying files that could corrupt files or backup services that could become counter-productive to the malicious execution. The list includes: mepocs, memtas, veeam, svc$, backup, sql, vss, msexchange, sql$, mysql, mysql$, sophos, MSExchange, MSExchange$, WSBExchange, PDVFSService, BackupExecVSSProvider, BackupExecAgentAccelerator, BackupExecAgentBrowser, BackupExecDiveciMediaService, BackupExecJobEngine, BackupExecManagementService, BackupExecRPCService, GxBlr, GxVss, GxClMgrS, GxCVD, GxCIMgr, GXMMM, GxVssHWProv, GxFWD, SAPService, SAP, SAP$, SAPD$, SAPHostControl, SAPHostExec, QBCFMonitorService, QBDBMgrN, QBIDPService, AcronisAgent, VeeamNFSSvc, VeeamDeploymentService, VeeamTransportSvc, MVArmor, MVarmor64, VSNAPVSS, AcrSch2Svc.

Figure 3. Example of ransom note.

• A list of processes to be killed before executing the encryption process, with a similar target as the services list: agntsvc, dbeng50, dbsnmp, encsvc, excel, firefox, infopath, isqlplussvc, msaccess, mspub, mydesktopqos, mydesktopservice, notepad, ocautoupds, ocomm, ocssd, onenote, oracle, outlook, powerpnt, sqbcoreservice, sql, steam, synctime, tbirdconfig, thebat, thunderbird, visio, winword, wordpad, xfssvccon, *sql*, bedbh, vxmon, benetns, bengien, pvlsvr, beserver, raw_agent_svc, vsnapvss, CagService, QBIDPService, QBDBMgrN, QBCFMonitorService, SAP, TeamViewer_Service, TeamViewer, tv_w32, tv_x64, CVMountd, cvd, cvfwd, CVODS, saphostexec, saposcol, sapstartsrv, avagent, avscc, DellSystemDetect, EnterpriseClient, VeeamNFSSvc, VeeamTransportSvc, VeeamDeploymentSvc.
• A list of excluded directories, filenames and file extensions to ensure the computer is operative after the encryption.
  • Directories: system volume information, intel, $windows.~ws, application data, $recycle.bin, mozilla, $windows.~bt, public, msocache, windows, default, all users, tor browser, programdata, boot, config.msi, google, perflogs, appdata, windows.old.
  • Filenames: desktop.ini, autorun.inf, ntldr, bootsect.bak, thumbs.db, boot.ini, ntuser.dat, iconcache.db, bootfont.bin, ntuser.ini, ntuser.dat.log.
  • File extensions: themepack, nls, diagpkg, msi, lnk, exe, cab, scr, bat, drv, rtp, msp, prf, msc, ico, key, ocx, diagcab, diagcfg, pdb, wpx, hlp, icns, rom, dll, msstyles, mod, ps1, ics, hta, bin, cmd, ani, 386, lock, cur, idx, sys, com, deskthemepack, shs ,ldf, theme, mpa, nomedia, spl, cpl, adv, icl, msu.

The ransom note then points to a Tor onion domain with the field ‘access-key=’ to identify the victim and show the price to recover their files with the Decrypt App. Prices are indicated in Bitcoin and Monero, the latest has a discount over Bitcoin.

Recommended actions

1. Maintain software with the latest security updates.
2. Monitor and strongly, regularly communicate to employees to not open and report suspicious emails.
3. Use a backup system to backup server files.
4. Install Antivirus and/or endpoint detection and response on all endpoints.
5. Make sure two-factor authentication is enabled in all services.

Conclusion

Recent ransomware attacks performed on German oil suppliers were successful, but they did not have a significant impact on the country's infrastructure. However, considering geo-political events in Eastern Europe, these attacks should serve as a strong reminder that organizations must remain on high alert against cyberattacks. They should examine recent campaigns such as those run with BlackCat malware to educate  teams and maintain up-to-date detections for the latest threat actor tactics, techniques, and procedures (TTPs). Like most attacks and threat actor campaigns, BlackCat ransomware can achieve Initial Access using many different variations that are dependent on the affiliate operating the attack. However, the payload will be very similar for infections. Blue teams can use this technical information to improve their readiness against the latest RaaS attacks.

Alien Labs will continue to monitor variations of BlackCat malware and will update any activities on the Alien Labs Open Threat Exchange™, which is a free, global open threat intelligence community with more than 200,000 users publishing updated threat intelligence daily. We deliver this information in the form of “pulses” that can be shared publicly and privately. In addition, members of OTX can download millions of indicators of compromise (IOCs), including those associated with BlackCat through integration with the platform.

Alien Labs is tracking IOCs associated with the geo-political conflict in Eastern Europe, through tagged pulses that track incident and related threat intelligence. To get the most updated information join OTX and visit this URL to see the full list of pulses associated with potential campaigns that may be related to the Ukranian/Russian conflict and threat actors targeting other countries.   

Appendix A. Detection methods

The following associated detection methods are in use by Alien Labs. They can be used by readers to tune or deploy detections in their own environments or for aiding additional research.

rule BlackCat : WindowsMalware {

   meta:

      author = "AlienLabs"

      description = "Detects BlackCat payloads."

      SHA256 = "6660d0e87a142ab1bde4521d9c6f5e148490b05a57c71122e28280b35452e896"


    strings:


        $rust = "/rust/" ascii wide


        $a0 = "vssadmin.exe Delete Shadows /all /quietshadow" ascii

        $a1 = "bcdedit /set {default}bcdedit /set {default} recoveryenabled No" ascii wide

        $a2 = "Services\\LanmanServer\\Parameters /v MaxMpxCt /d 65535" ascii wide

        $a3 = ".onion/?access-key=${ACCESS_KEY}" ascii wide


        $b0 = "config_id" ascii

        $b1 = "public_key" ascii

        $b2 = "extension" ascii

        $b3 = "note_file_name" ascii

        $b4 = "enable_esxi_vm_kill" ascii

        $b5 = "enable_esxi_vm_snapshot_kill" ascii



    condition:

        uint16(0) == 0x5A4D and filesize < 5MB and $rust and 2 of ($a*) and 3 of ($b*)

}

rule LinuxBlackCat : LinuxMalware {

    meta:

        author = "AlienLabs"

        description = "Detects BlackCat payloads."

        SHA256 = "5121f08cf8614a65d7a86c2f462c0694c132e2877a7f54ab7fcefd7ee5235a42"

    strings:

        $rust = "/rust/" ascii wide

        $a0 = "esxcli vm process kill --type=force --world-id=" ascii wide

        $a1 = ".onion/?access-key=${ACCESS_KEY}" ascii wide


        $b0 = "config_id" ascii

        $b1 = "public_key" ascii

        $b2 = "extension" ascii

        $b3 = "note_file_name" ascii

        $b4 = "enable_esxi_vm_kill" ascii

        $b5 = "enable_esxi_vm_snapshot_kill" ascii


    condition:

        uint32(0) == 0x464c457f and filesize < 5MB and $rust and all of ($a*) and 3 of ($b*)

}

Appendix B. Associated indicators (IOCs)

The following technical indicators are associated with the reported intelligence. A list of indicators is also available in the OTX Pulse. Please note, the pulse may include other activities related but out of the scope of the report.

Appendix C. Mapped to MITRE ATT&CK

The findings of this report are mapped to the following MITRE ATT&CK Matrix techniques:

• TA0005: Defense Evasion
  • T1070: Indicator Removal on Host
    • T1070.001: Clear Windows Event Logs
  • T1078: Valid Accounts
    • T1078.003: Local Accounts
  • T1562: Impair Defenses
    • T1562.001: Disable or Modify Tools
• TA0010: Exfiltration
  • T1048: Exfiltration Over Alternative Protocol
    • T1048.002: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
• TA0040: Impact
  • T1486: Data Encrypted for Impact

Appendix D. Reporting context

The following list of sources was used by the report author(s) during the collection and analysis process associated with this intelligence report.

1. https://www.varonis.com/blog/alphv-blackcat-ransomware
2. https://unit42.paloaltonetworks.com/blackcat-ransomware

Alien Labs rates sources based on the Intelligence source and information reliability rating system to assess the reliability of the source and the assessed level of confidence we place on the information distributed. The following chart contains the range of possibilities, and the selection applied to this report..

Source reliability A1

Information reliability A2

Feedback

AT&T Alien Labs welcomes feedback about the reported intelligence and delivery process. Please contact the Alien Labs report author or contact labs@alienvault.com.