Group Profile: BlackCat
Perfil del grupo ransomware segun BushidoUK Ransomware Vulnerability Matrix. Incluye vulnerabilidades conocidas, herramientas y TTPs asociadas.
BlackCat's Exploited Vulnerabilities
> [!NOTE]
> This is the list of vulnerabilities that have been observed during intrusions that lead to BlackCat ransomware deployment or data exfiltration and leaks published to BlackCat's Tor Site
Citrix
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|
| NetScaler ADC & Gateway | CVE-2023-4966 ("Citrixbleed") | BlackCat | <a href="https://therecord.media/fidelity-national-financial-ransomware-alphv-black-cat" rel="noopener" target="_blank">therecord.media</a> |
ConnectWise
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|
| ScreenConnect | CVE-2024-1708 & CVE-2024-1709 | BlackCat | <a href="https://www.bleepingcomputer.com/news/security/fbi-cisa-warn-us-hospitals-of-targeted-blackcat-ransomware-attacks/" rel="noopener" target="_blank">bleepingcomputer.com</a> |
Linux System Utilities
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|
| Polkit pkexec | CVE-2021-4034 ("Pwnkit") | BlackCat | <a href="https://www.crowdstrike.com/en-us/blog/anatomy-of-alpha-spider-ransomware/" rel="noopener" target="_blank">crowdstrike.com</a> |
Windows & MS Server Products
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|
| Exchange On-Prem | CVE-2021-34523, CVE-2021-34473, CVE-2021-31207 ("ProxyShell") | BlackCat | <a href="https://www.trendmicro.com/en_gb/research/22/d/an-investigation-of-the-blackcat-ransomware.html" rel="noopener" target="_blank">trendmicro.com</a> |
| Secondary Logon Service | CVE-2016-0099 | BlackCat | <a href="https://web.archive.org/web/20231004015829/https://go.kaspersky.com/rs/802-IJN-240/images/Common-TTPs-of-the-modern-ransomware_low-res.pdf" rel="noopener" target="_blank">kaspersky.com</a> |
Pulse Secure / Ivanti
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|
| Ivanti EPM Cloud Services Appliance (CSA) | CVE-2021-44529 | BlackCat | <a href="https://www.crowdstrike.com/en-us/blog/anatomy-of-alpha-spider-ransomware/" rel="noopener" target="_blank">crowdstrike.com</a> |
SonicWall
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|
| SMA 100 | CVE-2019-7481 | BlackCat | <a href="https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/blackcat" rel="noopener" target="_blank">blackberry.com</a> |
VMware
| Product | CVE(s) | Ransomware Group(s) | Source(s) |
|---|
| vSphere Client | CVE-2021-21972 | BlackCat | <a href="https://www.crowdstrike.com/en-us/blog/anatomy-of-alpha-spider-ransomware/" rel="noopener" target="_blank">crowdstrike.com</a> |
---
#### Sources
| Date Published | Report |
|---|
| 29 February 2024 | https://www.crowdstrike.com/en-us/blog/anatomy-of-alpha-spider-ransomware/ |
| 27 February 2024 | https://www.bleepingcomputer.com/news/security/fbi-cisa-warn-us-hospitals-of-targeted-blackcat-ransomware-attacks/ |
| 27 November 2023 | https://therecord.media/fidelity-national-financial-ransomware-alphv-black-cat |
| 31 March 2023 | https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/blackcat |
| 23 June 2022 | https://go.kaspersky.com/rs/802-IJN-240/images/Common-TTPs-of-the-modern-ransomware_low-res.pdf |
| 18 April 2022 | https://www.trendmicro.com/en_gb/research/22/d/an-investigation-of-the-blackcat-ransomware.html |
Referencias