Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Вход Регистрация
MITRE ATT&CK - Инструмент BlackCat
CVE уязвимости
БДУ ФСТЭК уязвимости
НКЦКИ уязвимости
MITRE ATT&CK
БДУ ФСТЭК
Новая БДУ ФСТЭК
Риски
Каталоги
MITRE ATT&CK
Инструмент
BlackCat
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

BlackCat

BlackCat is ransomware written in Rust that has been offered via the Ransomware-as-a-Service (RaaS) model. First observed November 2021, BlackCat has been used to target multiple sectors and organizations in various countries and regions in Africa, the Americas, Asia, Australia, and Europe.(Citation: Microsoft BlackCat Jun 2022)(Citation: Sophos BlackCat Jul 2022)(Citation: ACSC BlackCat Apr 2022)
ID: S1068
Associated Software: Noberus ALPHV
Type: MALWARE
Platforms: Windows
Created: 28 Feb 2023
Last Modified: 15 Jun 2023

Associated Software Descriptions
Name Description
Noberus (Citation: ACSC BlackCat Apr 2022)
ALPHV (Citation: Microsoft BlackCat Jun 2022)(Citation: ACSC BlackCat Apr 2022)

Techniques Used
Domain ID Name Use
Enterprise T1548 .002 Abuse Elevation Control Mechanism: Bypass User Account Control

BlackCat can bypass UAC to escalate privileges.(Citation: Microsoft BlackCat Jun 2022)

Enterprise T1087 .002 Account Discovery: Domain Account

BlackCat can utilize `net use` commands to identify domain users.(Citation: Microsoft BlackCat Jun 2022)
Enterprise T1059 .003 Command and Scripting Interpreter: Windows Command Shell

BlackCat can execute commands on a compromised network with the use of `cmd.exe`.(Citation: Microsoft BlackCat Jun 2022)
Enterprise T1491 .001 Defacement: Internal Defacement

BlackCat can change the desktop wallpaper on compromised hosts.(Citation: Microsoft BlackCat Jun 2022)(Citation: Sophos BlackCat Jul 2022)
Enterprise T1561 .001 Disk Wipe: Disk Content Wipe

BlackCat has the ability to wipe VM snapshots on compromised networks.(Citation: Microsoft BlackCat Jun 2022)(Citation: Sophos BlackCat Jul 2022)
Enterprise T1222 .001 File and Directory Permissions Modification: Windows File and Directory Permissions Modification

BlackCat can use Windows commands such as `fsutil behavior set SymLinkEvaluation R2L:1` to redirect file system access to a different location after gaining access into compromised networks.(Citation: Microsoft BlackCat Jun 2022)
Enterprise T1070 .001 Indicator Removal: Clear Windows Event Logs

BlackCat can clear Windows event logs using `wevtutil.exe`.(Citation: Microsoft BlackCat Jun 2022)
Enterprise T1069 .002 Permission Groups Discovery: Domain Groups

BlackCat can determine if a user on a compromised host has domain admin privileges.(Citation: Microsoft BlackCat Jun 2022)

Groups That Use This Software
ID Name References
G1015 Scattered Spider

(Citation: CISA Scattered Spider Advisory November 2023) (Citation: MSTIC Octo Tempest Operations October 2023)

References

  1. Australian Cyber Security Centre. (2022, April 14). 2022-004: ACSC Ransomware Profile - ALPHV (aka BlackCat). Retrieved December 20, 2022.
  2. Brandt, Andrew. (2022, July 14). BlackCat ransomware attacks not merely a byproduct of bad luck. Retrieved December 20, 2022.
  3. Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.
  4. CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.
  5. Microsoft. (2023, October 25). Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction. Retrieved March 18, 2024.
Навигация

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.