A Recent String of Attacks Demonstrates How BlackCat Continues to Infect Computers Worldwide Behind Unpatched Firewalls and VPN Services

OXFORD, U.K.  — July 14, 2022 —

Sophos, a global leader in next-generation cybersecurity, today revealed in the article, “BlackCat Ransomware Attacks Not Merely a Byproduct of Bad Luck,” that the ransomware gang has added Brute Ratel, a pentesting tool, to its arsenal of attack tools. The article details a string of ransomware attacks in which BlackCat used unpatched or outdated firewalls and VPN services to infiltrate vulnerable networks and systems worldwide across various industries.

BlackCat ransomware first emerged in November 2021 as the self-declared newest “leader” in the ransomware-as-a-service business, and quickly drew attention for its unusual coding language, Rust.

As soon as December 2021, targeted organizations called in Sophos Rapid Response to investigate at least five attacks involving BlackCat. In four of these incidents, the initial infection occurred by exploiting vulnerabilities in different firewall vendors’ products. One of these vulnerabilities was from 2018 and another emerged last year. Once inside the network, the attackers were able to obtain VPN credentials stored on these firewalls to log in as authorized users and then move laterally throughout the systems using remote desktop protocol (RDP).

As seen in prior BlackCat incidents, the attackers also leveraged open source and commercially available tools to create additional backdoors and alternative pathways for remote access to targeted systems. These included TeamViewer, nGrok, Cobalt Strike, and Brute Ratel.

“What we’re seeing with BlackCat and other attacks recently is that threat actors are very efficient and effective in their work. They use tried and true methods, like attacking vulnerable firewalls and VPNs, because they know these still work. But they show innovation to avoid security defenses, like switching to the newer post-exploitation C2 framework Brute Ratel in their attacks,” said Christopher Budd, senior manager, threat research, Sophos.

There was no clear pattern to the attacks; they occurred across the U.S., Europe, and Asia at large corporations operating in different industry segments. However, the targeted companies did share certain environmental vulnerabilities that simplified the attackers’ work, including outdated systems that could no longer be updated with the latest security patches, a lack of multifactor authentication for VPNs, and flat networks (where every machine can see every other machine in the network).

“The common denominator with all these attacks is that they were easy to carry out. In one instance, the same BlackCat attackers installed cryptominers a month before launching the ransomware. This latest research highlights how important it is to follow established best security practices; they still have a lot of power to prevent and thwart attacks, including multiple attacks against a single network.”

To learn more about the string of BlackCat attacks, read “BlackCat Ransomware Attacks Not Merely a Byproduct of Bad Luck” on Sophos.com.

Sophos experts have also put together an nGrok Incident Response Guide to help security teams prevent attackers from abusing the nGrok tool on their network.

About Sophos

Sophos is a global leader and innovator of advanced security solutions for defeating cyberattacks, including Managed Detection and Response (MDR) and incident response services and a broad portfolio of endpoint, network, email, and cloud security technologies. As one of the largest pure-play cybersecurity providers, Sophos defends more than 600,000 organizations and more than 100 million users worldwide from active adversaries, ransomware, phishing, malware, and more. Sophos’ services and products connect through the Sophos Central management console and are powered by Sophos X-Ops, the company’s cross-domain threat intelligence unit. Sophos X-Ops intelligence optimizes the entire Sophos Adaptive Cybersecurity Ecosystem, which includes a centralized data lake that leverages a rich set of open APIs available to customers, partners, developers, and other cybersecurity and information technology vendors. Sophos provides cybersecurity-as-a-service to organizations needing fully managed security solutions. Customers can also manage their cybersecurity directly with Sophos’ security operations platform or use a hybrid approach by supplementing their in-house teams with Sophos’ services, including threat hunting and remediation. Sophos sells through reseller partners and managed service providers (MSPs) worldwide. Sophos is headquartered in Oxford, U.K. More information is available at www.sophos.com.