BlackCat Ransomware Affiliate TTPs | Huntress

Category	Details
Threat Actors	ALPHV/BlackCat Ransomware group, using Ransomware-as-a-service (RaaS).
Campaign Overview	Attack targeting healthcare sector via a compromised ScreenConnect instance. Ransomware executed, with efforts to move laterally within the network.
Target Regions (Or Victims)	Healthcare community, likely through Managed Service Providers (MSPs).
Methodology	- Initial access through compromised ScreenConnect instance. - Ransomware execution via curl and embedded commands. - Lateral movement via PsExec.
Product Targeted	ScreenConnect, Windows Defender, and Windows systems.
Malware Reference	Ransomware executable: iw0pjCKEzADKTMA5Xkv8ZxS6.exe (BlackCat RaaS).
Tools Used	- ScreenConnect for remote access. - curl.exe for downloading ransomware. - psexec.exe for lateral movement. - vssadmin.exe, wmic.exe for system manipulation.
Vulnerabilities Exploited	Authentication bypass in ScreenConnect (likely from earlier versions) and weak endpoint security mechanisms.
TTPs	- Exploit public-facing applications (T1190). - Use of valid domain accounts (T1078.002). - Disable/modify tools (T1562.001). - Data encryption for impact (T1486).
Attribution	Likely ALPHV/BlackCat group, leveraging RaaS to distribute ransomware.
Recommendations	- Ensure up-to-date asset inventories. - Implement strict access controls. - Reduce attack surface by removing unnecessary applications/services. - Apply strong endpoint protection.
Source	Huntress Blog

Read full article: Read More

Disclaimer: The above summary has been generated by an AI language model.