# MA-921.042023: MyCERT Advisory - BlackCat Ransomware

**Date:** 11 Apr 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-921.042023  
**Advisory ID:** MA-921.042023

---

**1.0 Introduction**
MyCERT has observed an increase in ransomware-
**2.0 Impact**
The malicious actors’ use of Rust to deliver the ransomware payload sets the stage for its encryption routine. The ransomware binary defaces the system’s background images. It replaces it with one containing a notification that important files have been downloaded and encrypted, plus information on where additional instructions can be found. Sample ransom note is as below:
Figure 1: Sample ransom note of the BlackCat ransomware binary.
- The payload also terminates specific services 
- In addition, a new variant of the BlackCat ransomware binary restarts the affected system to safe mode before proceeding to its encryption routine. It also disables system recovery and deletes volume shadow copies to inhibit the recovery of the affected systems.
**3.0 Affected Products**
- Windows 7 and higher (7, 8.1, 10,11; 2008r2, 2012, 2016, 2019, 2022).
- Windows XP and 2003.
- VMware ESXi
- Debian and Ubuntu Linux
- ReadyNAS, Synology, QNAP
**4.0 Technical Details**
BlackCat/ALPHV ransomware leverages previously compromised user credentials to gain initial access to the victim’s system. Once the malware establishes access, it compromises Active Directory user and administrator accounts. The malware uses Windows Task Scheduler to configure malicious Group Policy Objects (GPOs) to deploy ransomware. Initial malware deployment leverages PowerShell scripts in conjunction with Cobalt Strike and disables security features within the victim’s network. BlackCat/ALPHV ransomware also leverages Windows administrative tools and Microsoft Sysinternals tools during compromise.
BlackCat/ALPHV steals victim data before the execution of the ransomware, including from cloud providers where company or client data was stored.
The actors leverage Windows scripting to deploy ransomware and to compromise additional hosts. For example, the following batch and PowerShell scripts were observed:
- start.bat - launches the ransomware executable with the required arguments.
- est.bat  - copies the ransomware to other locations.
- drag-and-drop-target.bat  - launches the ransomware executable for the MySQL Server.
- run.bat  - executes a callout command to and external server using SSH – file names may change depending on the company and systems affected.
- Runsl.psl - PowerShell scripts to disable AV.
**5.0 Indicators of Compromise**
The following are characteristics of compromise by BlackCat/ALPHV, as mid-February 2022:
**6.0 Kill Chain and Techniques**
Figure 4: Kill chain of BlackCat ransomware
**7.0 Recommendations**
MyCERT recommends users to apply the following mitigations to reduce the risk of compromised by BlackCat/ALPHV ransomware:
1. Review domain controllers, servers, workstations, and active directories for new or unrecognized user accounts.
2. Regularly back up data, air gap, and password protect backup copies offline. Ensure copies of critical data are not accessible for modification or deletion from the system where the data resides.
3. Review Task Scheduler for unrecognized schedule tasks. Additionally, manually review operating system defined or recognized schedule tasks for unrecognized “actions” (for example: review the steps each scheduled task is expected to perform).
4. Review antivirus logs for indicators they were unexpectedly turned off.
5. Implement network segmentation.
6. Require administrator credentials to install software.
7. Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, secure location (e.g., hard drive, storage device, the cloud).
8. Install updates/patch operating systems, software and firmware as soon as updates/patches are released.
9. Use multifactor authentication where possible.
10. Regularly change passwords to network systems and accounts, and avoid reusing password for different accounts.
11. Implement the shortest acceptable timeframe for password changes.
12. Disable unused remote access/Remote Desktop Protocol (RDP) ports and monitor remote access/RDP logs.
13. Audit user accounts with administrative privileges and configure access controls with least privilege in mind.
14. Install and regularly update antivirus and anti-malware software on all hosts.
15. Only use secure networks and avoid using public Wi-Fi networks. Consider installing and using a virtual private network (VPN).
16. Consider adding an email banner to emails received from outside your organization.
17. Disable hyperlinks in received emails.
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://www.cisa.gov/news-events/alerts/2022/04/22/fbi-releases-iocs-associated-blackcatalphv-ransomware>
- <https://www.ic3.gov/Media/News/2022/220420.pdf>
- <https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackcat>
- <https://www.beforecrypt.com/en/blackcat-ransomware-decryption/>