19 October 2021

CISA, FBI and NSA share advice on how to defend against BlackMatter ransomware attacks


CISA, FBI and NSA share advice on how to defend against BlackMatter ransomware attacks

The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the National Security Agency (NSA) have released a joint warning about BlackMatter, a relatively new ransomware operation that has targeted multiple U.S. critical infrastructure entities, including two U.S. Food and Agriculture Sector organizations in the last few months.

The past BlackMatter ransomware victims include the U.S. farmers cooperative NEW Cooperative and Japanese technology giant Olympus.

Active since July 2021, the ransomware operation is thought to be a rebrand of the DarkSide RaaS that shut down after the attack that crippled the Colonial Pipeline, the largest pipeline system for refined oil products in the U.S.

BlackMatter ransomware operators have attacked numerous U.S.-based organizations and have demanded ransom payments ranging from $80,000 to $15,000,000 in Bitcoin and Monero, the three agencies said.

The new security advisory provides details on how the BlackMatter ransomware gang operates, including tactics, techniques, and procedures (TTPs), as well as detection signatures and mitigations to help identify and block network activity associated with the threat.

“Using embedded, previously compromised credentials, BlackMatter leverages the Lightweight Directory Access Protocol (LDAP) and Server Message Block (SMB) protocol to access the Active Directory (AD) to discover all hosts on the network. BlackMatter then remotely encrypts the hosts and shared drives as they are found,” the advisory said.

“BlackMatter actors use a separate encryption binary for Linux-based machines and routinely encrypt ESXi virtual machines. Rather than encrypting backup systems, BlackMatter actors wipe or reformat backup data stores and appliances.”

CISA, the FBI, and NSA have also released a set of additional mitigations for critical infrastructure organizations to help them reduce the risk of credential compromise.

  • Disable the storage of clear text passwords in LSASS memory.

  • Consider disabling or limiting New Technology Local Area Network Manager (NTLM) and WDigest Authentication.

  • Implement Credential Guard for Windows 10 and Server 2016 (Refer to Microsoft: Manage Windows Defender Credential Guard for more information). For Windows Server 2012R2, enable Protected Process Light for Local Security Authority (LSA).

  • Minimize the AD attack surface to reduce malicious ticket-granting activity. Malicious activity such as “Kerberoasting” takes advantage of Kerberos’ Ticket Granting service and can be used to obtain hashed credentials that attackers attempt to crack.

  • Set a strong password policy for service accounts.

  • Audit Domain Controllers to log successful Kerberos Ticket-Granting Service requests and ensure the events are monitored for anomalous activity.


Back to the list

Latest Posts

Amid Pegasus scandal, Israel bans cyber software sales to 65 countries

Amid Pegasus scandal, Israel bans cyber software sales to 65 countries

Dropped countries include such countries as Morocco, Mexico, Saudi Arabia, or the UAE.
26 November 2021
CronRAT: New Linux malware that hides behind February 31 to stay undetected

CronRAT: New Linux malware that hides behind February 31 to stay undetected

The malware hides in the Linux calendar system and enables server-side Magecart data theft which bypasses browser-based security solutions.
26 November 2021
New malware campaign targets crypto, NFT and DeFi communities via Discord

New malware campaign targets crypto, NFT and DeFi communities via Discord

The Babadeda crypter is able to bypass signature-based antivirus solutions and was previously observed in malicious campaigns distributing RATs, and LockBit ransomware.
26 November 2021