Alert - ALPHV/BlackCat Ransomware Targeting of Canadian Industries

Audience

This Alert is intended for IT professionals and managers.

Purpose

An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.

Details

The Communications Security Establishment (CSE) and its Canadian Centre for Cyber Security (Cyber Centre) are aware of incidents where victims were infected with ALPHV/BlackCat ransomware. As of July 24, 2023, incidents involving ALPHV/BlackCat have impacted multiple sectors within Canada and globally.

The Cyber Centre assesses that ALPHV/BlackCat are almost certainly financially motivated and have shown no pattern to victimization that suggests deliberate targeting. The Cyber Centre assesses that ALPHV/BlackCat and its affiliates very likely select their victims based on opportunity. ALPHV/BlackCat is responsible for a significant share of attributed Canadian ransomware incidents that the Cyber Centre is aware of between January 2022 and June 2023. ALPHV/BlackCat has presented a threat to Canadian organizations since at least January 2022 and will very likely continue to threaten Canadian and international organizations into the latter half of 2023.

In 2023, BlackBerry published an article which details the BlackCat malware ^{Footnote 1}. In the report they state “BlackCat has most often targeted companies in the financial, manufacturing, legal, and professional services industries — but BlackCat’s exploits span all industries.” With a campaign that “often employ a triple-extortion tactic: making individual ransom demands for the decryption of infected files; for not publishing stolen data; and for not launching denial of service (DoS) attacks."

The Cyber Centre continues to monitor activities impacting Canadian Ransomware victims and will provide further technical indicators along with advice and guidance as they are made available. The Cyber Centre is providing the following TTPs and attached IOCs related to activity recently reported to the Cyber Centre to provide network defenders techniques to better protect themselves. All government and non-government partners are also encouraged to use cyber security best practices to protect their environments.^{Footnote 2}

Tactics, techniques, and procedures (TTP)

The following MITRE ATT&CK techniques leveraged by the actors^{Footnote 3} were reported to the Cyber Centre or referenced through open-source. They are being provided to outline the reported activity. MITRE provides detection and mitigation strategies for system operators to better protect their network systems. These resources are available in the references section of this Alert.

Initial access

Threat actors have been reportedly using multiple forms of social engineering to gain access to user credentials. This has included phishing email and SMS messages with links to target-themed credential phishing, as well as phone calls to the users to harvest their credentials.^{Footnote 4}

• T1586 – Compromise Accounts
• T1566 – Phishing

Threat actors have also been reportedly bypassing MFA by various means, including MFA fatigue and social engineering. ^{Footnote 4}

• T1111 - Multi-Factor Authentication Interception

Privilege escalation

Threat actors have been reportedly leveraging compromised credentials to conduct additional credential theft to escalate privileges.^{Footnote 4} Threat actors have also been reportedly compromising privileged accounts as part of the initial access.

• TA0004 – Privilege Escalation

Command and control (C2)

Following initial compromise, threat actors have also been reportedly using various remote monitoring and management tools to maintain persistence, many of which are commercial products to avoid detection.^{Footnote 4}

• T1219 – Remote Access Software

Scanning

Following initial compromise, threat actors have been reportedly leveraging various tools to scan for RDP and SMB enabled devices on the network.^{Footnote 5}

• T1135 – Network Share Discovery
• T1046 – Network Service Discovery

Persistence

Threat actors have been reportedly adding their own MFA tokens to existing user accounts. This allows the threat actor to maintain persistence while avoiding detection.^{Footnote 4}

• T1098.005 - Account Manipulation: Device Registration

Threat actors have also been reportedly adding federated domains to Azure AD to maintain persistence.

• T1484.002 – Domain Policy Modification: Domain Trust Modification

Threat actors have also been reportedly using scheduled tasks to maintain persistence^{Footnote 5}

• T1053.005 – Scheduled Task/Job: Scheduled Task

Threat actors have also been reportedly using various remote monitoring and management tools to maintain persistence, many of which are commercial products to avoid detection.^{Footnote 4}

• T1219 – Remote Access Software

Threat actors have also been reportedly abusing continuous configuration management software such as Ansible to maintain persistence. These tools are abused to automatically re-infect new systems.

• T1525 - Implant Internal Image

Movement within network

To move laterally within the network, threat actors have been reportedly leveraging management tools such as Microsoft InTune and WSUS to spread within the network.

• T1072 - Software Deployment Tools

Threat actors have also been reportedly using RDP connections to perform further credential theft via LSASS dumping.^{Footnote 6}

• T1021.001 - Remote Services: Remote Desktop Protocol

Recovery prevention and obstruction

To prevent and obstruct recovery efforts, threat actors have been reportedly deleting virtual machine backups and snapshots. Threat actors have also been reportedly deleting Windows shadow copy backups during the encryption process.^{Footnote 1}

• T1490 – Inhibit System Recovery

Suggested actions

The Cyber Centre recommends organizations:

• Review the attached indicators of compromise and above TTPs to determine if related activity has occurred. If activity has been detected and a compromise has occurred:
  • Reimage compromised systems.
  • Reset all potentially compromised credentials.
• Review the MITRE ATT&CK techniques and mitigations^{Footnote 3} to assist in reducing potential threat surfaces.

In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre’s Top 10 IT Security Actions^{Footnote 2} with an emphasis on the following topics.

• Phishing Awareness. This includes both identification of phishing but also procedures on what to do if a phishing email is received.
  • The Cyber Centre has several publications available on Phishing Awareness^{Footnote 7Footnote 8Footnote 9}.
• Phishing Technical Controls.
• Multi-factor Authentication.
  • Favouring hard tokens for sensitive or critical systems or accounts.
• Enforcing the Management of Administrative Privileges.
  • Minimize number of administrators and privileged roles.
  • Conduct administrative activities on managed, hardened, and dedicated devices with restricted access to email, web browsing and outside connectivity.
  • Enable two-person integrity when resetting administrative accounts to minimize successful social engineering activities.
• Remote Access Management and Controls.
• Network segmentation and demilitarized zones (DMZs).
  • Configure firewalls to selectively control and monitor traffic passed between zones.
• Software Management and Deployment Controls.
• Business continuity planning, which is tested and validated.
• Review the Cyber Centres Playbook on Ransomware (ITSM.00.099) and apply recommended security controls.^{Footnote 10}

If activity matching the content of this alert is discovered, recipients are encouraged to report via the My Cyber Portal, or email contact@cyber.gc.ca.

Indicators of compromise

The Cyber Centre is releasing the following indicators of compromise (IoCs) associated with ALPHV/BlackCat activity. The Cyber Centre wishes to highlight that some of the provided network indicators may be used for legitimate purposes. The presence of connections to these network indicators does not necessarily imply that a system has been compromised, but it does merit further investigation to verify the systems integrity.

Additionally, as these indicators may contain legitimate infrastructure or software, it is important to verify business services and network environments before implementing any blocks based on these indicators.

MITRE ATT&CK techniques

• ID: T1586.002 – Compromise Accounts: Email Accounts
• ID: T1586 – Compromise Accounts
• ID: T1566 – Phishing
• ID: T1111 - Multi-Factor Authentication Interception
• ID: TA0004 – Privilege Escalation
• ID: T1219 – Remote Access Software
• ID: T1135 – Network Share Discovery
• ID: T1046 – Network Service Discovery
• ID: T1098.005 - Account Manipulation: Device Registration
• ID: T1484.002 – Domain Policy Modification: Domain Trust Modification
• ID: T1053.005 – Scheduled Task/Job: Scheduled Task
• ID: T1219 – Remote Access Software
• ID: T1525 - Implant Internal Image
• ID: T1072 - Software Deployment Tools
• ID: T1021.001 - Remote Services: Remote Desktop Protocol
• ID: T1490 – Inhibit System Recovery