An analysis of two ransomware attacks has identified overlaps in the tactics, techniques, and procedures (TTPs) between BlackCat and BlackMatter, indicating a strong connection between the two groups.
While it’s typical of ransomware groups to rebrand their operations in response to increased visibility into their attacks, BlackCat (aka Alphv) marks a new frontier in that the cyber crime cartel is built out of affiliates of other ransomware-as-a-service (RaaS) operations.
BlackCat first emerged in November 2021 and has since targeted several organizations worldwide over the past few months. It has been called out for being similar to BlackMatter, a short-lived ransomware family that originated from DarkSide, which attracted notoriety for its high-profile attack on Colonial Pipeline in May 2021.
In an interview with Recorded Future’s The Record last month, a BlackCat representative dismissed rumors that it’s a rebranding of BlackMatter, while noting that it’s made up of affiliates associated with other RaaS groups.
“In part, we are all connected to gandrevil [GandCrab / REvil], blackside [BlackMatter / DarkSide], mazegreggor [Maze / Egregor], lockbit, etc., because we are adverts (aka affiliates),” the unnamed representative was quoted as saying. “We borrowed their advantages and eliminated their disadvantages.”
“BlackCat seems to be a case of vertical business expansion,” Cisco Talos researchers Tiago Pereira and Caitlin Huey said. “In essence, it’s a way to control the upstream supply chain by making a service that is key to their business (the RaaS operator) better suited for their needs and adding another source of revenue.”
What’s more, the cybersecurity firm said it observed a number of commonalities between a BlackMatter attack in September 2021 and that of a BlackCat attack from December 2021, including the tools and the file names used as well as a domain employed to maintain persistent access to the target network.
This overlapping use of the same command-and-control address has raised the possibility that the affiliate that used BlackMatter was likely one of the early adopters of BlackCat, with both the attacks taking more than 15 days to reach the encryption stage.
“As we have seen several times before, RaaS services come and go. Their affiliates, however, are likely to simply move on to a new service. And with them, many of the TTPs are likely to persist,” the researchers said.
The findings come as BlackBerry detailed a new .NET-based ransomware family called LokiLocker that not only encrypts the files but also incorporates an optional wiper functionality that’s designed to erase all non-system files and overwrite the master boot record (MBR) should a victim refuse to pay up within a specified timeframe.
“LokiLocker works as a limited-access ransomware-as-a-service scheme that appears to be sold to a relatively small number of carefully vetted affiliates behind closed doors,” the researchers said. Active since at least August 2021, a majority of victims detected so far are concentrated in Eastern Europe and Asia.