A joint alert has been issued by the Federal Bureau of Investigation (FBI), National Security Agency (NSA), and the Cybersecurity and Infrastructure Security Agency (CISA) about ongoing BlackMatter ransomware attacks.
The group has been conducting attacks in the United States since July 2021, which have included attacks on critical infrastructure entities and two organizations in the U.S. Food and Agriculture Sector. Evidence has been obtained that links the gang to the DarkSide ransomware gang that conducted attacks between September 2020 and May 2021, including the attack on Colonial Pipeline, with BlackMatter ransomware potentially a rebrand of the DarkSide operation.
Investigations into the attacks have allowed the agencies to obtain important information about the tactics, techniques, and procedures (TTPs) of the group, and an analysis has been performed on a sample of the ransomware in a sandbox environment.
The group is known to use previously compromised credentials to gain access to victims’ networks, then leverages the Lightweight Directory Access Protocol (LDAP) and Server Message Block (SMB) protocol to access the Active Directory (AD) and discover all hosts on the network. The BlackMatter gang deploys ransomware and remotely encrypts the hosts and shared drives as they are identified. The gang is known to exfiltrate data and typically demands ransom payments of between $80,000 and $15 million in Bitcoin or Monero.
In the joint alert, the NSA, FBI, and CISA shared TTPs, provide Snort signatures that can be used for detecting the network activity associated with BlackMatter ransomware attacks, and several mitigations to reduce the risk of a compromise by the gang.
Mitigations include:
- Implementing detection signatures to identify and block attacks in progress
- Using strong passwords resistant to brute force attacks
- Implementing multi-factor authentication to block the use of stolen credentials
- Patching and updating systems promptly
- Limiting access to resources over networks
- Implementing network segmentation and traversal monitoring
- Using admin disabling tools to support identity and privileged access management
- Implementing and enforcing backup and restoration policies and procedures
The alert, TTPs, and mitigations can be found here.
The post Alert Issued About Ongoing BlackMatter Ransomware Attacks appeared first on HIPAA Journal.