BlackByte affiliates use new encryptor and new TTPs
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-37085 | Authentication Bypass in VMware ESXi via AD Group Recreation VMware ESXi is vulnerable to an authentication bypass (CWE-305) when the host is configured to use Active Directory for user management. An attacker who has sufficient Active Directory permissions can delete the AD group tied to ESXi administration (typically the default 'ESXi Admins' group) and then re-create it, causing ESXi to treat the re-created group as the original administrator group. This grants the actor full access to the ESXi host without needing ESXi credentials themselves. Only ESXi hosts that were joined to and configured with Active Directory for user management are affected; hosts using local authentication are not. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-07-30 with known ransomware use, and EPSS assigns a high 26.8% probability of exploitation in the next 30 days (98th percentile). Do: Apply the security updates or mitigations published in the vendor's (VMware/Broadcom) advisory for your ESXi release, per the CISA KEV required action. As interim mitigation, protect the configured AD admin group (default 'ESXi Admins') from deletion or re-create it with the original identity, and restrict AD permissions that allow arbitrary group deletion. Since ransomware use is known, audit AD logs for deletion/re-creation of the 'ESXi Admins' group and verify integrity of any AD-joined ESXi hosts. | 7.2 | 27% | KEV ransomware |
| mass≈100,000+ ESXi hosts (tens of thousands are internet-exposed in public scans, and the installed base is far larger, though only AD-joined hosts are vulnerable) |
Full article631 words · extracted from helpnetsecurity.com · click to collapse
BlackByte, the ransomware-as-a-service gang believed to be one of Conti’s splinter groups, has (once again) created a new iteration of its encryptor.
“Talos observed some differences in the recent BlackByte attacks. Most notably, encrypted files across all victims were rewritten with the file extension ‘blackbytent_h’, which has not yet appeared in public reporting,” researchers with Cisco’s threat intelligence team have shared.
“This newer version of the encryptor also drops four vulnerable drivers as part of BlackByte’s usual Bring Your Own Vulnerable Driver (BYOVD) technique, which is an increase from the two or three drivers described in previous reports.”
New TTPs
Based on findings related to attacks that Cisco’s incident responders recently helped investigate, it’s obvious that some of BlackByte’s affiliates have been using tactics, techniques and procedures that depart from the group’s established tradecraft.
Aside from leveraging the new encryptor, affiliates have been:
- Exploiting CVE-2024-37085 – an authentication bypass vulnerability in VMware ESXi – to encrypt multiple virtual machines simultaneously
- Using victims’ authorized remote access mechanism instead of deploying remote administration tool like AnyDesk
- Using valid credentials – most likely discovered through brute-forcing – to access the victim organizations’ VPN
“Given BlackByte’s history of exploiting public-facing vulnerabilities for initial access, the use of VPN for remote access may represent a slight shift in technique or could represent opportunism. The use of the victim’s VPN for remote access also affords the adversary other advantages, including reduced visibility from the organization’s EDR,” the researchers noted.
For lateral movement, the attackers used Server Message Block (SMB) and Remote Desktop Protocols (RDP), and stole and misused NTLM hashes for authentication.
“Dynamic analysis of the ransomware binary later revealed consistent use of NTLM for authentication by that file, as well. We found that its execution routine includes creation of a service on the local system, and scanning for network shares on other networked systems using Active Directory credentials that were captured from the victim environment. We don’t have details of the exact system-to-system transmission method, but this very likely takes place over SMB to network shares that are discovered during the scanning process,” the researchers told Help Net Security.
“BlackByte has been known to leverage remote services such as SMB/Windows Admin shares throughout previous campaigns. The service on the local system then executes the copied binary on the remote system using the credentials built into the binary.”
As in previous attacks, the threat actors made modifications to the system registry to tamper with security tool configurations and manually uninstalled EDRs from key systems.
The victims
BlackByte victims – as published on their data leak site – are predominantly businesses in the manufacturing, construction and transportation/warehousing sector.
But the researchers think that the true number of BlackByte victims is much higher.
“Our estimate of a 20-30 percent victim post rate is based on the number of victims seen on BlackByte’s data leak site compared to the number of attacks we discovered in our telemetry during the same period by pivoting on indicators shared between those attacks,” they told Help Net Security.
Why some victims get “outed” on the data leak site and others not may depend on a combination of factors, “such as victims paying the ransom before they’re posted to the data leak site, the adversary focusing on attacks with encryption but no exfiltration of victim data, attacks conducted by a RaaS affiliate that isn’t authorized to use the data leak site, or simply a desire by BlackByte to keep a lower profile by being selective with victim posts.”
Based on the findings related to the newest BlackByte attacks, Cisco’s researchers have shared updated recommendations for defenders, as well as the latest indicators of compromise.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2024/08/28/blackbyte-new-encryptor-ttps/