NEUR SITE Oct 1 2021 Blogs Ignition Technology Takes A Look At Ransomware Attack On Technology Giant, Olympus BlackMatter is a new ransomware threat that was found in late July of this year. Despite having been around for such a short space of time, BlackMatter has already been held responsible for a number of ransomware attacks, including it’s most high profile attack on the multinational tech company, Olympus. Investigating BlackMatter with BlackBerry Protect At Ignition, we ran internal tests to see just how effective BlackBerry’s AI-Driven anti-malware solution, BlackBerry Protect, would be at stopping this latest threat. A sample of the malware (SHA-256: 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6) was found online on a reputable malware repository site, and then run through a number of tests. The first test involved BlackMatter being tested against the latest stable version of BlackBerry Protect, the second test involved the same version of BlackBerry Protect, but after being put in offline mode through lack of network connectivity. The third and final test saw BlackMatter Ransomware pitted against a 26 month old version (that had not been updated) of BlackBerry Protect – released a whole two years before BlackMatter was first seen out in the wild. On all three of the tests, the ransomware executable was downloaded onto a local machine, and on all three of the tests, BlackBerry Protect was able to scan and swiftly quarantine the ransomware file. Proving the high efficacy of BlackBerry Protect and its ability to quarantine threats that have never before been seen. Measuring the effectiveness of BlackBerry Protect The effectiveness of BlackBerry Protect comes largely from the fact that it is completely non-reliant upon signatures, instead using its market leading Artificial Intelligence (AI) engine to understand how an executable file is structured and what purpose the file serves. This is why the older BlackBerry Protect agent was able to quarantine the ransomware. The agent didn’t have to rely upon the file having already been seen, and thus a signature being written for it, it was able to make a decision based on the make-up of the file itself. Another point observed during testing was the ability of BlackBerry Protect to work offline. The AI engine, responsible for categorising a file, sits locally on the endpoint- meaning that even if network connectivity is lost, the BlackBerry Protect agent and its features are not affected. BlackMatter vs BlackBerry Protect Summary Critics may argue that Ransomware strains such as BlackMatter have many variations and thus such testing proves little, but, as alluded to before, due to the predictive ML-built analysis of BlackBerry Protect, it is able to protect against variations never seen anywhere before, providing true Zero-day protection. Take A Closer Look At BlackBerry Protect Do you want to find out more about BlackBerry Protect? Get in touch with the Ignition Technology BlackBerry team, blackberry@ignition-technology.com or visit the website for more information and resources here. Category: Blogs By Penny Lewis 1st October 2021 Tags: how does ransomware affect me? Paul Risk protect yourself ransomware security threat protection Author: Penny Lewis https://ignition-technology.com Related Posts Putting the X in XDR 11th November 2021 Ransomware – The Kick-Off 27th October 2021 Ransomware – Our new campaign 17th September 2021 The what, why & how of Asset Management 2nd September 2021 XDR: The Ultimate TLA 17th August 2021 Ransomware & How It Affects Me 3rd August 2021 Follow Us On Twitter Tweets by @ignition_tech Other News Putting the X in XDR 11th November 2021 Ransomware – The Kick-Off 27th October 2021 Ignition Technology Takes A Look At Ransomware Attack on Technology Giant, Olympus 1st October 2021 Ransomware – Our new campaign 17th September 2021 The what, why & how of Asset Management 2nd September 2021 XDR: The Ultimate TLA 17th August 2021 About Ignition We believe in the power of the channel to deliver technology innovations that drive business growth. We exist to help our channel partners stay relevant and add value to their customers in a world of rapid change, growing complexity and heightened security threats. European HQ Cody Technology Park Ively Road Farnborough Hampshire United Kingdom GU14 0LX +44 (0)20 3873 6580 Find us on: Useful Links About Us Become a Partner Events News Press Room Newsletter First Name Last Name Email Address © 2020 Ignition Technology Ltd, an Exclusive Networks Company Privacy Policy Ethics and Code of Conduct Whistleblowing Policy