Talos Details BlackByte Ransomware Attacks and Tactics
Summary
Cisco Talos reports BlackByte remained active worldwide, using phishing or unpatched systems for access, then tools such as AnyDesk and LoLBins for lateral movement before deploying ransomware.
Key points
- Talos observed BlackByte attacks dating back to March 2022, with victims reported across multiple regions.
- Initial access may involve phishing or vulnerable, unpatched services, including SonicWall VPNs and Microsoft Exchange servers.
- Attackers use AnyDesk and legitimate administrative or penetration-testing tools to control systems and move laterally.
- Talos describes attackers adding administrator accounts and deploying ransomware after lateral movement; the process may disable Windows Defender.
- Talos could not obtain the ransomware files and says unique, obfuscated files for each victim may hinder detection by file hashes.
- Talos recommends keeping internet-facing systems patched and using layered security measures.
Article Details
- Attack Vectors
- BlackByte commonly gains network access through phishing or by exploiting vulnerable, unpatched applications or services, including SonicWall VPN and Microsoft Exchange servers affected by ProxyShell.
- In the analyzed incident, Talos could not confirm the initial infection vector, but reported indicators consistent with a compromised vulnerable Microsoft Exchange Server.
- After gaining access, the attackers elevate local and domain account privileges, move laterally, use AnyDesk to control victim machines, and add administrator accounts to maintain persistence.
- Defensive Notes
- Keep Microsoft Exchange Server and other internet-facing systems patched with the latest updates.
- Use layered security controls to help detect and block attacks.
- Cisco Talos recommends its listed Cisco security products and Snort rules for detecting or blocking activity associated with this threat.
MITRE ATT&CK
T1136 · Create AccountThe article says the attackers add additional administrator accounts to maintain persistence.T1190 · Exploit Public-Facing ApplicationThe article reports exploitation of vulnerable, internet-accessible applications or services, including SonicWall VPN and Microsoft Exchange servers affected by ProxyShell.T1219 · Remote Access ToolsBlackByte attackers install and use AnyDesk remote management software to control victim machines.T1562.001 · Disable or Modify ToolsThe ransomware process attempts to disable Windows Defender.T1566 · PhishingThe article says BlackByte often uses phishing to gain access to victim networks.
People
Threat Actors
Malware
Vendors
CiscoCisco Talos has been monitoring the BlackByte Ransomware Group for several months, infecting victims all over the world, from North America to Colombia, Netherlands, China, Mexico and Vietnam.SonicWalloften uses phishing and/or vulnerable unpatched applications or services like vulnerable versions of SonicWall VPN or the ProxyShell vulnerability in Microsoft Exchange servers to gain access to the victim's
Products
AnyDeskpenetration testing and legit administrator tools (LoLBins). In most incidents, they like to use the AnyDesk remote management software to control victim machines.Microsoft Exchange Serverthe initial infection vector in the case below, but we have indicators that a vulnerable Microsoft Exchange Server was compromised, which matches the previously described behavior of the BlackByte actor.SonicWall VPNoften uses phishing and/or vulnerable unpatched applications or services like vulnerable versions of SonicWall VPN or the ProxyShell vulnerability in Microsoft Exchange servers to gain access to the victim's network.Windows Defenderseems to be very similar to the complexe.exe one described in the FBI report. It also disables Windows Defender. The base64-obfuscated string 'VwBpAG4ARABlAGYAZQBuAGQA' decodes to 'WinDefend', which is the
Tools
netscanoldbinaries (LoLBins), besides other publicly available commercial and non-commercial software like 'netscanold' or 'psexec'. These tools are also often used by Administrators for legitimate tasks, so it can bePsExec(LoLBins), besides other publicly available commercial and non-commercial software like 'netscanold' or 'psexec'. These tools are also often used by Administrators for legitimate tasks, so it can be difficult toRaccinedecodes to 'WinDefend', which is the Windows Defender service. It then tries to disable Florian Roth's Raccine ransomware protection tool and a few other commands mentioned in the FBI document.
Countries
ChinaCisco Talos has been monitoring the BlackByte Ransomware Group for several months, infecting victims all over the world, from North America to Colombia, Netherlands, China, Mexico and Vietnam.ColombiaCisco Talos has been monitoring the BlackByte Ransomware Group for several months, infecting victims all over the world, from North America to Colombia, Netherlands, China, Mexico and Vietnam.MexicoCisco Talos has been monitoring the BlackByte Ransomware Group for several months, infecting victims all over the world, from North America to Colombia, Netherlands, China, Mexico and Vietnam.NetherlandsCisco Talos has been monitoring the BlackByte Ransomware Group for several months, infecting victims all over the world, from North America to Colombia, Netherlands, China, Mexico and Vietnam.United StatesVietnamCisco Talos has been monitoring the BlackByte Ransomware Group for several months, infecting victims all over the world, from North America to Colombia, Netherlands, China, Mexico and Vietnam.