Threat video1:00
BlackMatter v2.0 RSA-1024 Encryptor: Detection & IOCs
BlackMatter v2.0 pairs RSA-1024 with modified ChaCha20 and hides its config with aPLib. Includes 9 detection rules (one free in Splunk SPL) and 16 IOCs.
Read the full threat intel for BlackMatter v2.0 RSA-1024 Encryptor: Detection & IOCs →
Chapters
- 0:00The hookBlackMatter v2.0 emerges with hidden crypto.
- 0:04The storyDarkSide fell.
- 0:10Attack pathConfig resolved, beaconed C2.
- 0:25AttributionAttributed to BlackMatter.
- 0:29Indicators of compromise15 indicators to hunt: 2 domains, 4 URLs and 1 SHA-256 hash, and more.
- 0:38MITRE ATT&CK techniques15 ATT&CK techniques, from execution to impact.
- 0:43Remediation4 steps now: Block mojobiden[.]com and paymenthacks[.]com at DNS and web proxy.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00BlackMatter v2.0 emerges with hidden crypto.
0:05DarkSide fell.
0:06BlackMatter rose in July 2021.
0:10Config resolved, beaconed C2.
0:13ICMLuaUtil bypassed UAC.
0:15Tokens stolen, backups deleted, services halted.
0:19Files encrypted. Wallpaper and ransom note displayed.
0:25Attributed to BlackMatter. Confidence: low.
0:3015 indicators to hunt: 2 domains, 4 URLs and 1 SHA-256 hash, and more.
0:3815 ATT&CK techniques, from execution to impact.
0:434 steps now: Block mojobiden[.]com and paymenthacks[.]com at DNS and web proxy.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.