BlackCat Ransomware Affiliate TTPs | Huntress

Category	Details
Threat Actors	ALPHV/BlackCat Ransomware group, using Ransomware-as-a-service (RaaS).
Campaign Overview	Attack targeting healthcare sector via a compromised ScreenConnect instance. Ransomware executed, with efforts to move laterally within the network.
Target Regions (Or Victims)	Healthcare community, likely through Managed Service Providers (MSPs).
Methodology	– Initial access through compromised ScreenConnect instance. – Ransomware execution via curl and embedded commands. – Lateral movement via PsExec.
Product Targeted	ScreenConnect, Windows Defender, and Windows systems.
Malware Reference	Ransomware executable: iw0pjCKEzADKTMA5Xkv8ZxS6.exe (BlackCat RaaS).
Tools Used	– ScreenConnect for remote access. – curl.exe for downloading ransomware. – psexec.exe for lateral movement. – vssadmin.exe, wmic.exe for system manipulation.
Vulnerabilities Exploited	Authentication bypass in ScreenConnect (likely from earlier versions) and weak endpoint security mechanisms.
TTPs	– Exploit public-facing applications (T1190). – Use of valid domain accounts (T1078.002). – Disable/modify tools (T1562.001). – Data encryption for impact (T1486).
Attribution	Likely ALPHV/BlackCat group, leveraging RaaS to distribute ransomware.
Recommendations	– Ensure up-to-date asset inventories. – Implement strict access controls. – Reduce attack surface by removing unnecessary applications/services. – Apply strong endpoint protection.
Source	Huntress Blog

Read full article: Read More

Disclaimer: The above summary has been generated by an AI language model.