A Recent String of Attacks Demonstrates How BlackCat Continues to Infect Computers Worldwide Behind Unpatched Firewalls and VPN Services

OXFORD, U.K.  — Luglio 14, 2022 —

Sophos, a global leader in next-generation cybersecurity, today revealed in the article, “BlackCat Ransomware Attacks Not Merely a Byproduct of Bad Luck,” that the ransomware gang has added Brute Ratel, a pentesting tool, to its arsenal of attack tools. The article details a string of ransomware attacks in which BlackCat used unpatched or outdated firewalls and VPN services to infiltrate vulnerable networks and systems worldwide across various industries.

BlackCat ransomware first emerged in November 2021 as the self-declared newest “leader” in the ransomware-as-a-service business, and quickly drew attention for its unusual coding language, Rust.

As soon as December 2021, targeted organizations called in Sophos Rapid Response to investigate at least five attacks involving BlackCat. In four of these incidents, the initial infection occurred by exploiting vulnerabilities in different firewall vendors’ products. One of these vulnerabilities was from 2018 and another emerged last year. Once inside the network, the attackers were able to obtain VPN credentials stored on these firewalls to log in as authorized users and then move laterally throughout the systems using remote desktop protocol (RDP).

As seen in prior BlackCat incidents, the attackers also leveraged open source and commercially available tools to create additional backdoors and alternative pathways for remote access to targeted systems. These included TeamViewer, nGrok, Cobalt Strike, and Brute Ratel.

“What we’re seeing with BlackCat and other attacks recently is that threat actors are very efficient and effective in their work. They use tried and true methods, like attacking vulnerable firewalls and VPNs, because they know these still work. But they show innovation to avoid security defenses, like switching to the newer post-exploitation C2 framework Brute Ratel in their attacks,” said Christopher Budd, senior manager, threat research, Sophos.

There was no clear pattern to the attacks; they occurred across the U.S., Europe, and Asia at large corporations operating in different industry segments. However, the targeted companies did share certain environmental vulnerabilities that simplified the attackers’ work, including outdated systems that could no longer be updated with the latest security patches, a lack of multifactor authentication for VPNs, and flat networks (where every machine can see every other machine in the network).

“The common denominator with all these attacks is that they were easy to carry out. In one instance, the same BlackCat attackers installed cryptominers a month before launching the ransomware. This latest research highlights how important it is to follow established best security practices; they still have a lot of power to prevent and thwart attacks, including multiple attacks against a single network.”

To learn more about the string of BlackCat attacks, read “BlackCat Ransomware Attacks Not Merely a Byproduct of Bad Luck” on Sophos.com.

Sophos experts have also put together an nGrok Incident Response Guide to help security teams prevent attackers from abusing the nGrok tool on their network.

Informazioni su Sophos

Sophos è un’azienda leader nell’ambito della cybersecurity e protegge 600.000 organizzazioni in tutto il mondo con una piattaforma basata sull’IA e servizi a cura di esperti. Sophos viene incontro alle esigenze delle organizzazioni, adattandosi al loro livello di maturità di sicurezza informatica e crescendo insieme ai clienti per tutelarli dai cyberattacchi. La sua soluzione offre la combinazione ottimale tra machine learning, automazione e dati di intelligence sulle minacce in tempo reale, aggiungendo le competenze umane degli esperti del team Sophos X-Ops, che lavorano in prima linea per garantire monitoraggio, rilevamento e risposta alle minacce 24/7.
Sophos offre un servizio di Managed Detection and Response (MDR) leader di settore, nonché una linea completa di tecnologie di sicurezza, tra cui soluzioni per la protezione di endpoint, rete, e-mail e cloud, nonché Extended Detection and Response (XDR), rilevamento delle minacce all’identità (Identity Threat Detection and Response, ITDR) e SIEM next-gen. Unite a servizi di consulenza a cura di esperti, queste funzionalità aiutano le organizzazioni a ridurre proattivamente il rischio e a rispondere in maniera più tempestiva, ottenendo il giusto livello di visibilità e scalabilità richiesto per tenersi un passo avanti rispetto a minacce in continua evoluzione.
La strategia go-to-market di Sophos si basa su un ecosistema di Partner che include Managed Service Provider (MSP), Managed Security Service Provider (MSSP), Rivenditori e Distributori, integrazioni per il marketplace, e Partner Cyber Risk; questa strategia offre alle organizzazioni la flessibilità di scegliere come stabilire rapporti di fiducia per la protezione della loro attività.  Sophos ha sede a Oxford, nel Regno Unito. Ulteriori informazioni sono disponibili su www.sophos.it.