Recently, an expert analyzed ransomware attributed to the BlackCat or ALPHV group. In addition to interesting SFTP functions, an implemented data destruction function was also discovered there. Could this be a clue to the future of data extortion?
With ransomware-as-a-service (RaaS) and data leaks (DLS), the data extortion landscape is constantly seeing new innovations from threat actors, as well as acronyms from the security firms that track them. In this joint report, Cyderes and Stairwell examine evidence of a new tactic found in a BlackCat/ALPHV participant's exfiltration tool discovered during an investigation by Cyderes.
Ransomware investigation in detail
After an incident at Cyderes, the team found and analyzed the tool in the context of a BlackCat/ALPHV ransomware investigation. Cyderes performed an initial assessment and realized that the tool is an exfiltration tool with hard-coded SFTP credentials. Cyderes then used Stairwell's inception tool for additional analysis.
The sample was also sent to Stairwell's Threat Research Team, where analysis revealed a partially implemented data destruction feature. The use of data destruction by affiliate-level actors instead of deploying RaaS would mark a major shift in the data extortion landscape and signal the balkanization of financially-motivated intrusion actors currently operating under the banners of RaaS affiliate programs. Maybe this could be a new level of ransomware blackmail.
Tool is also used by BlackMatter
The examined sample is an executable .NET file designed for data exfiltration using FTP, SFTP and WebDAV protocols and includes functionality to corrupt the files on disk that have been exfiltrated. The exfiltration behavior of this sample closely matches previous reports from Exmatter, a .NET exfiltration tool used by at least one subsidiary of the BlackMatter ransomware group. The sample was observed by Cyderes in connection with the deployment of BlackCat/ALPHV ransomware, which is allegedly operated by affiliates of numerous ransomware groups, including BlackMatter. A further technical examination of the Stairwell sample is available on his website.
More at Staiwell.com