Microsoft Discovers New BlackCat Ransomware Variant

Microsoft's Threat Intelligence unit has recently discovered an advanced iteration of the infamous BlackCat ransomware. This updated version, known as BlackCat 3.0, is equipped with powerful tools: the Impacket networking framework and the Remcom hacking tool. These tools enable swift lateral movement and remote command execution within compromised networks.

The new variant, dubbed BlackCat 3.0 by Microsoft, was first brought to public attention by cybersecurity researcher VX-Underground in April. The developers behind the ransomware informed their affiliates that the code, including encryption, had been completely rewritten to enhance its ability to elude detection by antivirus and endpoint detection and response (AV/EDR) systems.

The IBM Security X-Force team subsequently conducted an in-depth analysis of the updated ransomware and found references to Impacket within its executable. Impacket is an open-source Python framework that’s frequently employed by penetration testers, red teamers, and threat actors to spread laterally on a network, extract sensitive information from processes, and more.

Microsoft's Threat Intelligence team has confirmed the presence of Impacket in the new BlackCat variant. Furthermore, the ransomware variant has incorporated the Remcom hacking tool, which functions as a remote shell for executing commands on other devices within a network.

According to Microsoft's observations, the BlackCat operation has been using the Impacket framework to conduct activities like credential duping and remote service execution, facilitating the widespread deployment of the ransomware across target networks. Microsoft revealed that the BlackCat affiliate known as 'Storm-0875' had been using this new version since July 2023.

BlackCat, also known as ALPHV, emerged onto the cyber threat landscape in November 2021 and is believed to have links with the DarkSide/BlackMatter gang. Renowned for its continuous evolution, the group has adopted innovative tactics over time, including the creation of a clearweb leak site and a data leak API for easier data dissemination.

As BlackCat evolves from a mere ransomware encryptor into a comprehensive post-exploitation toolkit, the pace and complexity of its attacks are poised to intensify. This progression poses challenges for defenders working to detect and mitigate its impact.

Moreover, BlackCat recently made headlines for its attack on Reddit, underscoring its persistent threat to organizations of different scales.