Threat Signal Report

Meet BlackMatter: Yet Another RaaS in the Wild

Description

FortiGuard Labs is aware that a brand new ransomware "BlackMatter" was found in the wild. BlackMatter is yet another Ransomware-as-a-Service, where the ransomware group provides tools such as ransomware, payment sites and operating manuals to its members and affiliates who then actually perform the dirty work such as finding and infecting the target with the provided tools. A security researcher who goes by the name pancak3 also tweeted in late July that BlackMatter gangs had posted on hacking forums that they wanted to purchase access to corporate networks from cyber criminals and potentially corporate insiders.

When was BlackMatter Ransomware Discovered in the Wild?

BlackMatter ransomware was discovered in late July.

What does FortiGuard Labs Know about BlackMatter ransomware/RaaS?

The BlackMatter gang made a couple of posts to hacking forums in late July.

One post asked to purchase access to corporate networks in the US, Canada, Australia, and the UK from cyber criminals and potentially corporate insiders for anywhere from $3,000 to $100,000. The targets must have minimum revenue of $100,000,000, 500 to 15,000 machines in the network, and must be previously untouched by other ransomware groups. Also BlackMatter is not willing to purchase access to healthcare and governmental organizations.

Other post states the rules and who they are. Their rules are simple: they do not attack hospitals, critical infrastructures (power plants, water treatment facilities, pipelines and oil refineries), defense industry, non-profit organizations and government sector. If companies who belong to the no-attack categories get infected with BlackMatter, the gang will offer free decryption as a sign of good will. Other ransomware gangs such as REvil and DarkSide have the same rules but some of their affiliates did not abide by these respective rules.

What does BlackMatter Do?

As BlackMatter is a ransomware, it encrypts the files on the compromised machines. When BlackMatter finds endpoint protection software installed on the compromised machine, file encryption occurs in "Safe Mode with Networking" where it can encrypt files without interference from the installed endpoint protection software. Unlike some other ransomware, BlackMatter is designed to encrypt Russian machines.

After the files are encrypted, BlackMatter replaces Wallpaper with the following statement:

BlackMatter Ransomware encrypted all your files!
To get your data back and keep your privacy safe, you must find [filename]txt file and follow the instructions!

BlackMatter ransom not does not state how much the victim must pay to recover the encrypted files but has instructions to install TOR browser and access their Onion website for further instructions.

Based on the screenshot posted on ID-ransomware, BlackMatter ransomware appears to double the ransom fee if the payment was not made before the deadline. Also the Onion site provides communication channel between the victim and the Blackmatter gang.

Screenshot courtesy of ID-Ransomware

How is BlackMatter Ransomware Delivered to the Victim?

Unknown, but other ransomware is delivered via spearphishing emails or deployed to the network that was already breached by other malware. As such, BlackMatter is most likely delivered in the same way. At the time of this writing, FortiGuard Labs is not aware of any vulnerabilities exploited to deliver BlackMatter ransomware.

How Widespread is BlackMatter ransomware?

At this time, there is no information available to assess how widespread BlackMatter infection is, however major corporations have not been hit with BlackMatter as the time of this writing.

What is the Status of Coverage?

FortiGuard Labs provides the following AV coverage against BlackMatter ransomware:

W32/BlackMatter.A!tr.ransom

W32/BlackMatter.B!tr.ransom

W32/BlackMatter.C!tr.ransom

Any Other Suggested Mitigation?

Recently demonstrated ProxyShell exploit chain is a good candidate to be used by BlackMatter gang to deliver its ransomware to the victims (ProxyShell can be used to deliver other malware too). As Microsoft has already released a patch for all three vulnerabilities utilized in ProxyShell, FortiGuard Labs recommends to apply the patch as soon as possible.

Due to the ease of disruption and potential for damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc., it is important to keep all AV and IPS signatures up to date. It is also important to ensure that all known vendor vulnerabilities within an organization are addressed, and updated to protect against attackers establishing a foothold within a network.

Also - organizations are encouraged to conduct ongoing training sessions to educate and inform personnel about the latest phishing/spearphishing attacks. They also need to encourage employees to never open attachments from someone they don't know, and to always treat emails from unrecognized/untrusted senders with caution. Since it has been reported that various phishing and spearphishing attacks have been delivered via social engineering distribution mechanisms, it is crucial that end users within an organization be made aware of the various types of attacks being delivered. This can be accomplished through regular training sessions and impromptu tests using predetermined templates by an organizations' internal security department. Simple user awareness training on how to spot emails with malicious attachments or links could also help prevent initial access into the network.