FBI and Secret Service Release Joint Advisory on BlackByte Ransomware

Threat Watch

Threat Watch FBI and Secret Service Release Joint Advisory on BlackByte Ransomware

FBI and Secret Service Release Joint Advisory on BlackByte Ransomware

On Friday, the FBI and Secret Service released a joint advisory indicating the BlackByte ransomware gang compromised multiple organizations within three US critical infrastructure sectors in the last three months. BlackByte is a Ransomware-as-a-Service (RaaS) group that offers encryption software, ransom negotiation, and money laundering services to cyber criminals in return for a percentage of the ransom. Individual compromises may have distinct criminal groups involved during different stages of the attack.

ANALYST NOTES

The advisory contains a number of recent indicators of Blackbyte ransomware gang activity. A number of hashes, suspicious file names, and base64 encoded powershell commands are included as well as a detailed list of commands executed during attacks. We recommend organizations use these commands as behavioral indicators to search endpoint logs for indications of past or ongoing compromise. Ransomware actors can have short time to ransom (TTR) measured in days, depending on the amount of time allocated to interfere with backup services.

https://www.bleepingcomputer.com/news/security/fbi-blackbyte-ransomware-breached-us-critical-infrastructure/

https://www.ic3.gov/Media/News/2022/220211.pdf

Using Microsoft Sentinel to Detect Confluence CVE-2022-26134 Exploitation

Russia may be Pressing Arrested Cyber Criminals into Service

Get To Know Bob Meindl, Our New CEO!

How Ransomware Capabilities Are Evolving and What You Can Do to Keep Your Organization Secure

Threat Watch