ALPHV (BlackCat) Ransomware
Recovery Services

What is Ransomware & How Was I Infected? 

Ransomware is a type of malware that prevents you from either accessing your systems or the data that is stored on it. It is designed to block access to a computer system until a sum of money is paid, with the hijacked system becoming locked, or the data on it being stolen, deleted, or encrypted. Ransomware uses a technique called asymmetric encryption, which uses a pair of keys to encrypt and decrypt a file; the attacker makes the private key available to the victim only after the ransom is paid. Ransomware will often attempt to spread to other computers on the same network, and overall, is extremely bad news for the victim.  

So, how were you infected? Unfortunately, there are a number of ways you could have been hit with ransomware. From unpatched servers and PCs, to email spam campaigns containing infectious files as attachments, or download links to untrustworthy download sources like torrents. Unofficial and freeware sites, and other third-party downloaders are often used, and illegal software activation tools known as ‘cracks’ can infect systems instead of activating licensed products. Infections can be spread through exploiting outdated program weaknesses too, so it might not be anything you did – but rather, what you did not do – such as ensuring your updates were in order. Unpatched firewalls have also been a leading area of breach in the past two years. The problem with ransomware is that even if you pay what the attacker asks, there are no guarantees that you will get access to your network, or your files again. Occasionally malware known as wiper malware is presented as ransomware, but after the ransom is paid the files are not decrypted. With the right help, you can better navigate these issues. 

What is ALPHV (BlackCat) Ransomware? 

ALPHV (BlackCat) ransomware is a very sophisticated ransomware that can target many different environments due to its many advanced features and the fact that it is human-operated. ALPHV (BlackCat) can employ four different encryption routines, use several cryptographic algorithms, and spread between computers. It can infect various Windows and Linux operating system versions and can also end running processes and close files that are open during encryption. Once BlackCat breaches a network, it searches and steals sensitive files before encrypting local systems. As with most major ransomware operations, the group behind BlackCat engages in double-extortion, where stolen data is used with the threat of leaking to put pressure on victims to pay. BlackCat goes a step further in diminishing recovery options in its victims by deleting Windows Shadow Volume Copies, deleting backups, and emptying the Recycle Bin too. BlackCat is one of the most sophisticated variants of ransomware this year, due to its extremely customizable features that allow for attacks on a extensive range of corporate environments. This feature rich variant is the first to be written in Rust programming language.

Why is BlackCat Ransomware So Problematic? 

The reason BlackCat is so problematic is purely due to how sophisticated it is. On top of this, the ransoms demanded by ALPHV (BlackCat) generally range from five to six digits in USD, with the largest sum so far being three million dollars’ worth of Bitcoin or Monero cryptocurrencies. In early 2022, it was confirmed that ALPHV (BlackCat) ransomware is linked to BlackMatter/Darkside ransomware operations.  

To avoid becoming hostage to BlackCat or other types of ransomware and malware, it is crucial to maintain recent offline backups of your most important files and data. Adopt a ‘defense-in-depth’ approach where you use layers of defense with several mitigations at each layer; this means you will have more opportunities to detect malware, and then stop it before it causes detrimental harm to your business. If you want to learn more about how to best prepare and protect your business from ransomware and other threats, there is a great article here – Reduce the Risk of Ransomware & Other Cyber Attacks.