Ransomwarecritical
Threat Assessment: BlackByte Ransomware
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-31207 | Security feature bypass in Microsoft Exchange Server (ProxyShell) enables webshell RCE | 6.6 | 100% | KEVRansomwarePoC | KEV |
CVE-2021-34473+1 related CVE | SSRF (CWE-918) in Microsoft Exchange Server Enabling RCE (ProxyShell) | 9.1 group max | 100% | KEVRansomwarePoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ntdetect.com | are as follows: Files ignored by the ransomware: BlackByte, ntdetect[.]com, bootnxt, NTLDR, recycle.bin, bootmgr, thumbs.db, ntuser. |
| ipv4 | 185.219.52.229 | reat actor attempts coming from the following IP addresses: 185[.]219.52[.]229 (RU), 198[.]144.189[.]74 (US), 45[.]137.190.193 (RU), 1 |
| ipv4 | 185.70.184.42 | .]229 (RU), 198[.]144.189[.]74 (US), 45[.]137.190.193 (RU), 185[.]70.184.42 (NL) and 198[.]54.131.44 (US), with the 185[.]70.184.42 I |
| ipv4 | 185.93.6.31 | s. This variant downloads a .png file from the IP addresses 185[.]93.6.31 and 45[.]9.148.114 prior to encryption. Security research |
| ipv4 | 198.144.189.74 | g from the following IP addresses: 185[.]219.52[.]229 (RU), 198[.]144.189[.]74 (US), 45[.]137.190.193 (RU), 185[.]70.184.42 (NL) and 1 |
| ipv4 | 198.54.131.44 | [.]74 (US), 45[.]137.190.193 (RU), 185[.]70.184.42 (NL) and 198[.]54.131.44 (US), with the 185[.]70.184.42 IP being the most persiste |
| ipv4 | 45.137.190.193 | ddresses: 185[.]219.52[.]229 (RU), 198[.]144.189[.]74 (US), 45[.]137.190.193 (RU), 185[.]70.184.42 (NL) and 198[.]54.131.44 (US), with |
| ipv4 | 45.9.148.114 | wnloads a .png file from the IP addresses 185[.]93.6.31 and 45[.]9.148.114 prior to encryption. Security researchers from SpiderLabs |
From the original article
11 min read at unit42.paloaltonetworks.com
BlackByte is ransomware as a service (RaaS) that first emerged in July 2021. Operators have exploited ProxyShell vulnerabilities to gain a foothold in the victim's environment. BlackByte has similarities to other ransomware variants such as Lockbit 2.
By Amer Elsad · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.