Security News > 2021 > October > FBI, CISA, NSA share defense tips for BlackMatter ransomware attacks
The Cybersecurity and Infrastructure Security Agency, the Federal Bureau of Investigation, and the National Security Agency published today an advisory with details about how the BlackMatter ransomware gang operates.
The joint cybersecurity advisory from CISA, the FBI, and the NSA shares the tactics, techniques, and procedures associated with BlackMatter activity that could help organizations protect against the BlackMatter ransomware gang.
"Notably, this variant of BlackMatter leverages the embedded credentials and SMB protocol to remotely encrypt, from the original compromised host" - joint advisory from CISA, FBI, and NSA. The BlackMatter file-encrypting malware also has a version for Linux-based systems that can encrypt VMware ESXi virtual servers, which are common in enterprise environments for resource management purposes.
The advisory today warns that, unlike other ransomware actors that encrypt backup data stores and appliances, the BlackMatter gang wipes or reformats them.
To counter BlackMatter ransomware attacks, CISA, the FBI, and the NSA shares a set of cybersecurity measures that start from the basic password hygiene and go to mitigations designed to minimize the Active Directory attack surface.
BlackMatter is among the top ransomware threats today.
News URL
Related news
- Medusa Ransomware Strikes 300+ Targets: FBI & CISA Urge Immediate Action to #StopRansomware (source)
- Hunters International ransomware claims attack on Tata Technologies (source)
- Toronto Zoo shares update on last year's ransomware attack (source)
- CISA tags critical Ivanti EPM flaws as actively exploited in attacks (source)
- CISA: Medusa ransomware hit over 300 critical infrastructure orgs (source)
- Ransomware gang creates tool to automate VPN brute-force attacks (source)
- SANS Institute Warns of Novel Cloud-Native Ransomware Attacks (source)
- ⚡ THN Weekly Recap: Router Hacks, PyPI Attacks, New Ransomware Decryptor, and More (source)
- BlackLock ransomware claims nearly 50 attacks in two months (source)
- TechRepublic EXCLUSIVE: New Ransomware Attacks are Getting More Personal as Hackers ‘Apply Psychological Pressure” (source)