BlackCat Adds Brute Ratel to Attack Tools: Sophos

The BlackCat also known as AlphaV is a ransomware family created in the Rust programming language and operated under a ransomware-as-a-service (RaaS) model. BlackCat Continues to Infect Computers Worldwide Behind Unpatched Firewalls and VPN Services. Gang targets large Corporations across the U.S., Europe and Asia operating in different industry segments.

BlackCat Ransomware Attacks Not Merely a By-product of Bad Luck,” that the ransomware gang has added Brute Ratel, a pen-testing tool, to its arsenal of attack tools. Let me detail the string of ransomware attacks in which BlackCat used unpatched or outdated firewalls and VPN services to infiltrate vulnerable networks and systems worldwide across various industries.

BlackCat ransomware first emerged in November 2021 as the self-declared newest “leader” in the ransomware-as-a-service business, and quickly drew attention for its unusual coding language, Rust.

Reports say, the initial infection occurred by exploiting vulnerabilities in different firewall vendors’ products. One of these vulnerabilities was from 2018 and another emerged last year. Once inside the network, the attackers were able to obtain VPN credentials stored on these firewalls to log in as authorized users and then move laterally throughout the systems using remote desktop protocol (RDP).

As seen in prior BlackCat incidents, the attackers also leveraged open source and commercially available tools to create additional backdoors and alternative pathways for remote access to targeted systems. These included TeamViewer, nGrok, Cobalt Strike, and Brute Ratel.

The BlackCat ransomware-as-a-service group, which may be a rebrand of the DarkSide or BlackMatter ransomware groups, is also known as Alphv. Its malware is coded with Rust, a programming language known for fast performance and structural protections against some types of bugs. Analysis by cybersecurity firm Varonis shows the group actively recruiting operators with promises that affiliates can keep 90% of victims' pay-outs.

The common denominator with all these attacks is that they were easy to carry out. In one instance, the same BlackCat attackers installed crypto-miners a month before launching the ransomware. This latest research highlights how important it is to follow established best security practices; they still have a lot of power to prevent and thwart attacks, including multiple attacks against a single network.