Experts Find Some Affiliates of BlackMatter Now Spreading BlackCat Ransomware

An analysis of two ransomware attacks has identified overlaps^[1]
in the tactics, techniques, and procedures (TTPs) between BlackCat
and BlackMatter, indicating a strong connection between the two
groups.

While it’s typical of ransomware groups to rebrand their
operations in response to increased visibility into their attacks,
BlackCat^[2]
(aka Alphv) marks a new frontier in that the cyber crime cartel is
built out of affiliates of other ransomware-as-a-service (RaaS)
operations.

BlackCat first emerged in November 2021 and has since targeted
several organizations worldwide over the past few months. It has
been called out for being similar to BlackMatter^[3], a short-lived
ransomware family that originated from DarkSide^[4], which attracted
notoriety for its high-profile attack on Colonial Pipeline^[5]
in May 2021.

In an interview with Recorded Future’s The Record last month, a
BlackCat representative dismissed rumors that it’s a rebranding of
BlackMatter, while noting that it’s made up of affiliates
associated with other RaaS groups.

“In part, we are all connected to gandrevil [GandCrab / REvil],
blackside [BlackMatter / DarkSide], mazegreggor [Maze / Egregor],
lockbit, etc., because we are adverts (aka affiliates),” the
unnamed representative was quoted^[6]
as saying. “We borrowed their advantages and eliminated their
disadvantages.”

“BlackCat seems to be a case of vertical business expansion,”
Cisco Talos researchers Tiago Pereira and Caitlin Huey said. “In
essence, it’s a way to control the upstream supply chain by making
a service that is key to their business (the RaaS operator) better
suited for their needs and adding another source of revenue.”

What’s more, the cybersecurity firm said it observed a number of
commonalities between a BlackMatter attack in September 2021 and
that of a BlackCat attack from December 2021, including the tools
and the file names used as well as a domain employed to maintain
persistent access to the target network.

This overlapping use of the same command-and-control address has
raised the possibility that the affiliate that used BlackMatter was
likely one of the early adopters of BlackCat, with both the attacks
taking more than 15 days to reach the encryption stage.

“As we have seen several times before, RaaS services come and
go. Their affiliates, however, are likely to simply move on to a
new service. And with them, many of the TTPs are likely to
persist,” the researchers said.

The findings come as BlackBerry detailed a new .NET-based
ransomware family called LokiLocker^[7]
that not only encrypts the files but also incorporates an optional
wiper functionality that’s designed to erase all non-system files
and overwrite the master boot record (MBR) should a victim refuse
to pay up within a specified timeframe.

“LokiLocker works as a limited-access ransomware-as-a-service
scheme that appears to be sold to a relatively small number of
carefully vetted affiliates behind closed doors,” the researchers
said. Active since at least August 2021, a majority of victims
detected so far are concentrated in Eastern Europe and Asia.