Read Time:13 Minute, 54 Second
This blog was jointly written with Santiago Cortes.
Executive summary
AT&T Alien Labs™ is writing this report about recently created ransomware malware dubbed BlackCat which was used in a January 2022 campaign against two international oil companies headquartered in Germany, Oiltanking and Mabanaft. The attack had little impact on end customers, but it does serve to remind the cybersecurity community of the potential for threat actors to continue attacks against critical infrastructure globally.
Key takeaways:
The ransomware BlackCat is coded in Rust and was created in November 2021.
Following trends observed last year by Alien Labs, the ransomware targets multiple platforms (Windows and Linux), and it uses additional code to infect VMware’s ESXi hypervisor.
Blackcat uses a “wall of shame” website to both blackmail victims, prove, and promote their latest campaigns publicly.
Campaigns remain active, with 16 known incidents in February 2022 as of the publishing of this report.
Background
The 2021 ransomware attack on US-based Colonial Pipeline, which impacted the fuel supply on the East Coast of America for several days, raised awareness of the reality that adversaries are well prepared to launch future cyberattacks globally that could severely impact a country’s infrastructure. Now, with confrontations in the Ukrainian region taking on new levels of urgency, there is heightened expectation of future threat actor campaigns against the critical infrastructure of western countries. The campaigns could take the form of ransomware attacks or data wiper attacks, as these have been the highly successful in recent years, especially when combined with supply chain attacks.
Analysis
German newspaper Handelsblatt stated the oil companies Oiltanking and Mabanaft had been affected by a ransomware attack on January 29, 2022, that impacted one of the key oil providers in the area. The attacks allegedly caused Shell to re-route their supplies in order to avoid severe impacts to the German fuel supply. Even with these actions, it’s been stated that 233 gas stations across Germany have been affected by the incident, resulting in those stations having to run some processes manually and only taking cash payment.
The malware behind these attacks is known as BlackCat ransomware, aka ALPHV, as reported by the same newspaper. The group operates with a ransomware-as-a-service (RaaS) business model, where the ransomware authors are entitled to 10-20% of the ransom payment, while the rest is kept by the affiliates deploying the payload. After a successful attack, victims who refuse to pay the ransom have their details posted on dark web forums to make attacks public, increasing their notoriety and shaming the affected organizations. According to these blogs, at least 10 companies may have been impacted by these ransomware campaigns in the first two weeks of February.
Since the malware family operates as a RaaS, the initial access vector depends on the affiliate party deploying the payload and can vary from one attacker to another. However, all of them appear to attempt to exfiltrate victims’ data before starting the encryption process, gaining extortion power for subsequent requests.
The BlackCat gang first appeared in mid-November 2021, and its payload is written in the Rust programming language, which is considered to have a similar performance to C/C++, but with better memory management to avoid memory errors and concurrent programming. Additionally, it is a cross platform language, allowing developers to target several operating systems with the same code. For these reasons, it has been voted as the “most loved programming language” in Stack Overflow since 2016.
Aside from the developing advantages Rust offers, the attackers also take advantage of a lower detection ratio from static analysis tools, which aren’t usually adapted to all programming languages. For this same reason, Go Language had become more popular among malware coders during last year, as seen in other blogs released by Alien Labs, including:
Blog TeamTNT Delivers Cryptomining Malware Using New Memory Loader
Blog BotenaGo
Rust has been present in malware samples for many years, but BlackCat is the first professionally/commercialized distributed malware family using it, and the most prosperous thus far.
When executed, the malware offers several options for customizing its execution. These options have evolved since its first version, shown in figure 2 which compares one of the first samples available (reported by MalwareHunterTeain December 2021) to the latest samples/versions.
Figure 1. @malwrhunterteam screenshot of execution.
Most arguments are optional, but access-token is enforced to bypass the dynamic analysis performed by automated sandboxes. However, any token provided bypasses the restriction and enables malware execution. This token, in addition to the host universally unique identifier (UUID), is later used to identify the victim in a Tor website hosted by the attackers, which displays the price for the files decryptor.
Among these options, Alien Labs has observed how some of them are specific to VMware ESXi. This inclusion follows trends observed in 2021 among other popular RaaS groups, like DarkSide or REvil, who added Linux capabilities to include VMware ESXi in their scope of potential targets. The hypervisor ESXi allows multiple virtual machines (VM) to share the same hard drive storage. However, this also enables attackers to encrypt the centralized virtual hard drives used to store data from across VMs, potentially causing disruptions to companies.
The BlackCat malware has code very similar to its predecessors. It first aims to stop any running VMs in ESXi. By doing this, the attacker ensures no other VM is handling the files to be encrypted, avoiding corruption issues of the encrypted files. Additionally, any ESXi snapshots are removed to harden recovery from the attack.
Additional preparation procedures are performed by the BlackCat malware on Windows systems. For example, it carries out some noisy activities that can be detected with Alien Labs correlation rules, as seen in Appendix A:
Delete Volume Shadow Copies Services to harden recovery from the attack. The command used is ‘vssadmin.exe Delete Shadows /all /quiet’.
Disables the recovery mode in BCDedit: ‘bcdedit.exe /set {default} recoveryenabled No’.
Maximize the value of network requests the Server Service can take by changing the value in the registry to 65535. This change eludes issues accessing too many files at once during the encryption process. The command used is: ‘reg add HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesLanmanServerParameters /v MaxMpxCt /d 65535 /t REG_DWORD /f ’.
If enabled, it attempts to propagate with psexec into different systems. The command runs from the %TEMP% folder, leveraging the credentials in the config file and the parent’s execution options for propagation options. ‘psexec.exe -accepteula \{Target} -u {user} -p {password} -s -d -f -c {payload}.exe {inherited execution flags}’.
Clears all the event logs with wevtutil with the command: ‘cmd.exe /c for /F “tokens=*” %1 in (‘wevtutil.exe el’) DO wevtutil.exe cl “%1″’.
In addition to the options shown in figure 1, the latest samples have added three additional functions that increase the ransomware capabilities. These changes maintain the line of work already seen, without including any major changes to the way the malware operates.
Figure 2. Latest sample executed.
The current default configuration file appended with the latest observed executable, includes among others:
The public key
The file extension to use for encrypted files, which corresponds to seven alphanumeric characters (0hzoagy for one of the latest samples)
A ransom note (see figure 3) contains the victim’s name multiple times as well as the type of files BlackCat has exfiltrated
A list of pre-obtained credentials from the victim that are to be used during execution
A list of services the victim should kill according to the attacker, before executing the encryption process — usually services modifying files that could corrupt files or backup services that could become counter-productive to the malicious execution. The list includes: mepocs, memtas, veeam, svc$, backup, sql, vss, msexchange, sql$, mysql, mysql$, sophos, MSExchange, MSExchange$, WSBExchange, PDVFSService, BackupExecVSSProvider, BackupExecAgentAccelerator, BackupExecAgentBrowser, BackupExecDiveciMediaService, BackupExecJobEngine, BackupExecManagementService, BackupExecRPCService, GxBlr, GxVss, GxClMgrS, GxCVD, GxCIMgr, GXMMM, GxVssHWProv, GxFWD, SAPService, SAP, SAP$, SAPD$, SAPHostControl, SAPHostExec, QBCFMonitorService, QBDBMgrN, QBIDPService, AcronisAgent, VeeamNFSSvc, VeeamDeploymentService, VeeamTransportSvc, MVArmor, MVarmor64, VSNAPVSS, AcrSch2Svc.
Figure 3. Example of ransom note.
A list of processes to be killed before executing the encryption process, with a similar target as the services list: agntsvc, dbeng50, dbsnmp, encsvc, excel, firefox, infopath, isqlplussvc, msaccess, mspub, mydesktopqos, mydesktopservice, notepad, ocautoupds, ocomm, ocssd, onenote, oracle, outlook, powerpnt, sqbcoreservice, sql, steam, synctime, tbirdconfig, thebat, thunderbird, visio, winword, wordpad, xfssvccon, *sql*, bedbh, vxmon, benetns, bengien, pvlsvr, beserver, raw_agent_svc, vsnapvss, CagService, QBIDPService, QBDBMgrN, QBCFMonitorService, SAP, TeamViewer_Service, TeamViewer, tv_w32, tv_x64, CVMountd, cvd, cvfwd, CVODS, saphostexec, saposcol, sapstartsrv, avagent, avscc, DellSystemDetect, EnterpriseClient, VeeamNFSSvc, VeeamTransportSvc, VeeamDeploymentSvc.
A list of excluded directories, filenames and file extensions to ensure the computer is operative after the encryption.
Directories: system volume information, intel, $windows.~ws, application data, $recycle.bin, mozilla, $windows.~bt, public, msocache, windows, default, all users, tor browser, programdata, boot, config.msi, google, perflogs, appdata, windows.old.
Filenames: desktop.ini, autorun.inf, ntldr, bootsect.bak, thumbs.db, boot.ini, ntuser.dat, iconcache.db, bootfont.bin, ntuser.ini, ntuser.dat.log.
File extensions: themepack, nls, diagpkg, msi, lnk, exe, cab, scr, bat, drv, rtp, msp, prf, msc, ico, key, ocx, diagcab, diagcfg, pdb, wpx, hlp, icns, rom, dll, msstyles, mod, ps1, ics, hta, bin, cmd, ani, 386, lock, cur, idx, sys, com, deskthemepack, shs ,ldf, theme, mpa, nomedia, spl, cpl, adv, icl, msu.
The ransom note then points to a Tor onion domain with the field ‘access-key=’ to identify the victim and show the price to recover their files with the Decrypt App. Prices are indicated in Bitcoin and Monero, the latest has a discount over Bitcoin.
Recommended actions
Maintain software with the latest security updates.
Monitor and strongly, regularly communicate to employees to not open and report suspicious emails.
Use a backup system to backup server files.
Install Antivirus and/or endpoint detection and response on all endpoints.
Make sure two-factor authentication is enabled in all services.
Conclusion
Recent ransomware attacks performed on German oil suppliers were successful, but they did not have a significant impact on the country’s infrastructure. However, considering geo-political events in Eastern Europe, these attacks should serve as a strong reminder that organizations must remain on high alert against cyberattacks. They should examine recent campaigns such as those run with BlackCat malware to educate teams and maintain up-to-date detections for the latest threat actor tactics, techniques, and procedures (TTPs). Like most attacks and threat actor campaigns, BlackCat ransomware can achieve Initial Access using many different variations that are dependent on the affiliate operating the attack. However, the payload will be very similar for infections. Blue teams can use this technical information to improve their readiness against the latest RaaS attacks.
Alien Labs will continue to monitor variations of BlackCat malware and will update any activities on the Alien Labs Open Threat Exchange™, which is a free, global open threat intelligence community with more than 200,000 users publishing updated threat intelligence daily. We deliver this information in the form of “pulses” that can be shared publicly and privately. In addition, members of OTX can download millions of indicators of compromise (IOCs), including those associated with BlackCat through integration with the platform.
Alien Labs is tracking IOCs associated with the geo-political conflict in Eastern Europe, through tagged pulses that track incident and related threat intelligence. To get the most updated information join OTX and visit this URL to see the full list of pulses associated with potential campaigns that may be related to the Ukranian/Russian conflict and threat actors targeting other countries.
Appendix A. Detection methods
The following associated detection methods are in use by Alien Labs. They can be used by readers to tune or deploy detections in their own environments or for aiding additional research.
USM Anywhere Correlation Rules
Removed all snapshots using vimcmd
Windows Shadow Copies Deletion
Windows PSExec Usage
Windows PSExec Service Usage
Windows SMB Server Maximum Concurrent Requests Set To Maximum Value
Windows Event Log Removed with wevtutil
Suspicious Bcdedit Usage
YARA RULES
rule BlackCat : WindowsMalware {
meta:
author = “AlienLabs”
description = “Detects BlackCat payloads.”
SHA256 = “6660d0e87a142ab1bde4521d9c6f5e148490b05a57c71122e28280b35452e896”
strings:
$rust = “/rust/” ascii wide
$a0 = “vssadmin.exe Delete Shadows /all /quietshadow” ascii
$a1 = “bcdedit /set {default}bcdedit /set {default} recoveryenabled No” ascii wide
$a2 = “Services\LanmanServer\Parameters /v MaxMpxCt /d 65535” ascii wide
$a3 = “.onion/?access-key=${ACCESS_KEY}” ascii wide
$b0 = “config_id” ascii
$b1 = “public_key” ascii
$b2 = “extension” ascii
$b3 = “note_file_name” ascii
$b4 = “enable_esxi_vm_kill” ascii
$b5 = “enable_esxi_vm_snapshot_kill” ascii
condition:
uint16(0) == 0x5A4D and filesize < 5MB and $rust and 2 of ($a*) and 3 of ($b*)
}
rule LinuxBlackCat : LinuxMalware {
meta:
author = “AlienLabs”
description = “Detects BlackCat payloads.”
SHA256 = “5121f08cf8614a65d7a86c2f462c0694c132e2877a7f54ab7fcefd7ee5235a42”
strings:
$rust = “/rust/” ascii wide
$a0 = “esxcli vm process kill –type=force –world-id=” ascii wide
$a1 = “.onion/?access-key=${ACCESS_KEY}” ascii wide
$b0 = “config_id” ascii
$b1 = “public_key” ascii
$b2 = “extension” ascii
$b3 = “note_file_name” ascii
$b4 = “enable_esxi_vm_kill” ascii
$b5 = “enable_esxi_vm_snapshot_kill” ascii
condition:
uint32(0) == 0x464c457f and filesize < 5MB and $rust and all of ($a*) and 3 of ($b*)
}
Appendix B. Associated indicators (IOCs)
The following technical indicators are associated with the reported intelligence. A list of indicators is also available in the OTX Pulse. Please note, the pulse may include other activities related but out of the scope of the report.
TYPE
INDICATOR
DESCRIPTION
SHA256
f2b3f1ed693021b20f456a058b86b08abfc4876c7a3ae18aea6e95567fd55b2e
Windows BlackCat Payload
SHA256
cefea76dfdbb48cfe1a3db2c8df34e898e29bec9b2c13e79ef40655c637833ae
Windows BlackCat Payload
SHA256
7e363b5f1ba373782261713fa99e8bbc35ddda97e48799c4eb28f17989da8d8e
Windows BlackCat Payload
SHA256
f837f1cd60e9941aa60f7be50a8f2aaaac380f560db8ee001408f35c1b7a97cb
Windows BlackCat Payload
SHA256
731adcf2d7fb61a8335e23dbee2436249e5d5753977ec465754c6b699e9bf161
Windows BlackCat Payload
SHA256
7b2449bb8be1b37a9d580c2592a67a759a3116fe640041d0f36dc93ca3db4487
Windows BlackCat Payload
SHA256
38834b796ed025563774167716a477e9217d45e47def20facb027325f2a790d1
Windows BlackCat Payload
SHA256
40f57275721bd74cc59c0c59c9f98c8e0d1742b7ae86a46e83e985cc4039c3a5
Windows BlackCat Payload
SHA256
b588823eb5c65f36d067d496881d9c704d3ba57100c273656a56a43215f35442
Windows BlackCat Payload
SHA256
f815f5d6c85bcbc1ec071dd39532a20f5ce910989552d980d1d4346f57b75f89
Windows BlackCat Payload
SHA256
0c6f444c6940a3688ffc6f8b9d5774c032e3551ebbccb64e4280ae7fc1fac479
Windows BlackCat Payload
SHA256
c5ad3534e1c939661b71f56144d19ff36e9ea365fdb47e4f8e2d267c39376486
Windows BlackCat Payload
SHA256
7154fdb1ef9044da59fcfdbdd1ed9abc1a594cacb41a0aeddb5cd9fdaeea5ea8
Windows BlackCat Payload
SHA256
658e07739ad0137bceb910a351ce3fe4913f6fcc3f63e6ff2eb726e45f29e582
Windows BlackCat Payload
SHA256
5bdc0fb5cfbd42de726aacc40eddca034b5fa4afcc88ddfb40a3d9ae18672898
Windows BlackCat Payload
SHA256
c8b3b67ea4d7625f8b37ba59eed5c9406b3ef04b7a19b97e5dd5dab1bd59f283
Windows BlackCat Payload
SHA256
bd337d4e83ab1c2cacb43e4569f977d188f1bb7c7a077026304bf186d49d4117
Windows BlackCat Payload
SHA256
28d7e6fe31dc00f82cb032ba29aad6429837ba5efb83c2ce4d31d565896e1169
Windows BlackCat Payload
SHA256
15b57c1b68cd6ce3c161042e0f3be9f32d78151fe95461eedc59a79fc222c7ed
Windows BlackCat Payload
SHA256
4e18f9293a6a72d5d42dad179b532407f45663098f959ea552ae43dbb9725cbf
Windows BlackCat Payload
SHA256
13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31
Windows BlackCat Payload
SHA256
c3e5d4e62ae4eca2bfca22f8f3c8cbec12757f78107e91e85404611548e06e40
Windows BlackCat Payload
SHA256
1af1ca666e48afc933e2eda0ae1d6e88ebd23d27c54fd1d882161fd8c70b678e
Windows BlackCat Payload
SHA256
3d7cf20ca6476e14e0a026f9bdd8ff1f26995cdc5854c3adb41a6135ef11ba83
Windows BlackCat Payload
SHA256
722f1c1527b2c788746fec4dd1af70b0c703644336909735f8f23f6ef265784b
Windows BlackCat Payload
SHA256
d767524e1bbb8d50129485ffa667eb1d379c745c30d4588672636998c20f857f
Windows BlackCat Payload
SHA256
aae77d41eba652683f3ae114fadec279d5759052d2d774f149f3055bf40c4c14
Windows BlackCat Payload
SHA256
be8c5d07ab6e39db28c40db20a32f47a97b7ec9f26c9003f9101a154a5a98486
Windows BlackCat Payload
SHA256
9f6876762614e407d0ee6005f165dd4bbd12cb21986abc4a3a5c7dc6271fcdc3
Windows BlackCat Payload
SHA256
79802d6a6be8433720857d2b53b46f8011ec734a237aae1c3c1fea50ff683c13
Windows BlackCat Payload
SHA256
2cf54942e8cf0ef6296deaa7975618dadff0c32535295d3f0d5f577552229ffc
Windows BlackCat Payload
SHA256
bacedbb23254934b736a9daf6de52620c9250a49686d519ceaf0a8d25da0a97f
Windows BlackCat Payload
SHA256
3c8ad2dae0b1bb536925b4e8d5a87e77c6134371eada2c7628358d6c6d3083dc
Windows BlackCat Payload
SHA256
67d1f4077e929385cfd869bf279892bf10a2c8f0af4119e4bc15a2add9461fec
Windows BlackCat Payload
SHA256
5a604a8f0e72f3bf7901b7b67f881031a402ab8072269c00233a554df548f54d
Windows BlackCat Payload
SHA256
6660d0e87a142ab1bde4521d9c6f5e148490b05a57c71122e28280b35452e896
Windows BlackCat Payload
SHA256
f8c08d00ff6e8c6adb1a93cd133b19302d0b651afd73ccb54e3b6ac6c60d99c6
Linux BlackCat Payload
SHA256
5121f08cf8614a65d7a86c2f462c0694c132e2877a7f54ab7fcefd7ee5235a42
Linux BlackCat Payload
SHA256
3a08e3bfec2db5dbece359ac9662e65361a8625a0122e68b56cd5ef3aedf8ce1
Linux BlackCat Payload
SHA256
f7a038f9b91c40e9d67f4168997d7d8c12c2d27cd9e36c413dd021796a24e083
Linux BlackCat Payload
SHA256
9802a1e8fb425ac3a7c0a7fca5a17cfcb7f3f5f0962deb29e3982f0bece95e26
Linux BlackCat Payload
Appendix C. Mapped to MITRE ATT&CK
The findings of this report are mapped to the following MITRE ATT&CK Matrix techniques:
TA0005: Defense Evasion
T1070: Indicator Removal on Host
T1070.001: Clear Windows Event Logs
T1078: Valid Accounts
T1078.003: Local Accounts
T1562: Impair Defenses
T1562.001: Disable or Modify Tools
TA0010: Exfiltration
T1048: Exfiltration Over Alternative Protocol
T1048.002: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
TA0040: Impact
T1486: Data Encrypted for Impact
Appendix D. Reporting context
The following list of sources was used by the report author(s) during the collection and analysis process associated with this intelligence report.
https://www.varonis.com/blog/alphv-blackcat-ransomware
https://unit42.paloaltonetworks.com/blackcat-ransomware
Alien Labs rates sources based on the Intelligence source and information reliability rating system to assess the reliability of the source and the assessed level of confidence we place on the information distributed. The following chart contains the range of possibilities, and the selection applied to this report..
Source reliability A1
RATING
DESCRIPTION
A – Reliable
No doubt about the source’s authenticity, trustworthiness, or competency. History of complete reliability.
B – Usually Reliable
Minor doubts. History of mostly valid information.
C – Fairly Reliable
Doubts. Provided valid information in the past.
D – Not Usually Reliable
Significant doubts. Provided valid information in the past.
E – Unreliable
Lacks authenticity, trustworthiness, and competency. History of invalid information.
F – Reliability Unknown
Insufficient information to evaluate reliability. May or may not be reliable.
Information reliability A2
RATING
DESCRIPTION
1 – Confirmed
Logical, consistent with other relevant information, confirmed by independent sources.
2 – Probably True
Logical, consistent with other relevant information, not confirmed.
3 – Possibly True
Reasonably logical, agrees with some relevant information, not confirmed.
4 – Doubtfully True
Not logical but possible, no other information on the subject, not confirmed.
5 – Improbable
Not logical, contradicted by other relevant information.
6 – Cannot be judged
The validity of the information can not be determined.
Feedback
AT&T Alien Labs welcomes feedback about the reported intelligence and delivery process. Please contact the Alien Labs report author or contact labs@alienvault.com.
