FlagThis

The BlackCat ransomware, known for its Rust-based code and sophisticated attack techniques, went inactive after successfully extorting a $22 million ransom from Change Healthcare. The group cited law enforcement interference as the reason for its shutdown. However, a new ransomware strain, Cicada3301, has emerged with striking similarities to BlackCat, suggesting a possible rebranding or continuation of the same operation. Both strains use similar toolsets, share code similarities, and exhibit similar functionality, including methods for shadow copy deletion and tampering. The similarities between BlackCat and Cicada3301 raise concerns about the potential return of a highly effective and dangerous ransomware group.

References:

• All CISA Advisories - CISA Adds Three Known Exploited Vulnerabilities to Catalog - 5d
• Cyble - Weekly IT Vulnerability Report: Cyble Urges Fixes for Ivanti, Microsoft Dark Web Exploits - 4d
• www.ivanti.com - October 2024 Security Update - Ivanti - 4d
• Over Security - Critical Vulnerability in Veeam Products Exploited by Ransomware Gangs - 3d
• @SophosXOps - Veeam Vulnerability (CVE-2024-40711) exploited by Ransomware Groups - 3d
• nvd.nist.gov - CVE-2024-40711 - Veeam Backup & Replication Remote Code Execution - 3d
• search.odin.io - Cyble Odin's search engine results for vulnerable Veeam instances exposed online. - 3d
• Security Archives - U.S. CISA adds Veeam Backup and Replication flaw to its Known Exploited Vulnerabilities catalog - 2d
• Malware Analysis, News and Indicators - An article analyzing the similarities between BlackCat and Cicada3301, raising concerns about a potential return of the ransomware group. - 6h
• securityintelligence.com - A Security Intelligence article exploring the connection between BlackCat and Cicada3301. - 6h
• Morphisec Cybersecurity Blog - While he says that code itself isn’t just a rehash of BlackCat, “the malware group has either seen the code base or are using the same developers. - 4h
• securityintelligence.com - It was the first piece of ransomware written in Rust. Choosing Rust let BlackCat engineers add customized features and implement measures that prevented malware analysis. - 4h

Classification:

• HashTags: Ransomware Cybersecurity BlackCat
• Company: IBM
• Target: Businesses
• Attacker: BlackCat
• Product: X-Force
• Feature: Threat Intelligence
• Type: Ransomware
• Severity: Medium