Top Threats

Back to discussions
Expand all | Collapse all

Joint Cybersecurity CISA, FBI, and NSA provides guidance concerning BlackMatter Ransomware.

  • 1.  Joint Cybersecurity CISA, FBI, and NSA provides guidance concerning BlackMatter Ransomware.

    Posted Oct 20, 2021 12:09:00 AM
      |   view attached
    Hi All,

    The CISA, FBI, and NSA just published BlackMatter Ransomware.

    Since July 2021, BlackMatter ransomware has targeted multiple U.S. critical infrastructure entities, including two U.S. Food and Agriculture Sector organizations.

    This advisory provides guidance on cyber actor tactics, techniques, and procedures (TTPs) obtained from a sample of BlackMatter ransomware analyzed in a sandbox environment as well from trusted third-party reporting. Using embedded, previously compromised credentials, BlackMatter leverages the Lightweight Directory Access Protocol (LDAP) and Server Message Block (SMB) protocol to access the Active Directory (AD) to discover all hosts on the network. BlackMatter then remotely encrypts the hosts and shared drives as they are found.

    ------------------------------
    Michael Roza CPA, CISA, CIA, MBA, Exec MBA
    ------------------------------

    Attachment(s)

    pdf
    NSA CISA FBI Blackmatter Ransomware 20211018.pdf   898 KB 1 version