Blackcat are Testing Strategies to Make Ransomware Attacks More Effective

Sampson Gideon September 27, 2022

6 1 minute read

Ransomware hackers are exploring a new kind of attack that, rather than encrypting data, outrightly destroys it. The goal is to make it unthinkable for the target to fetch their data if they don’t pay the ransom.

Ransomware is one of the massive cybersecurity problems facing the world presently. While many targets refuse to give in to the shakedown, many believe they have no choice but to settle for a decryption key.

Based on cybersecurity researchers at Cyderes and Stairwell, at least one ransomware group is exercising ‘data destruction attacks’.

Blackcat may Gain More Leverage Against Victims

This could be tricky for ransomware victims because while it’s often likely to retrieve encrypted data without paying a ransom, the danger of completely eroding servers if they fail to comply could lead them to pay.

Recently, BlackCat claimed responsibility for a chain of ransomware occurrences around the world, but ransomware culprits are always researching new ways to make attacks more productive – it seems they’re testing a new method with malware that erodes data.

Moreover, researchers linked the data wreckage to Exmatter, a .NET exfiltration instrument that was part of BlackMatter ransomware attacks.

Essentially, many presume that BlackCat is a rebrand of BlackMatter – which in turn was a rebrand of Darkside, the ransomware undertaking behind the Colonial Pipeline attack.

In prior ransomware attacks, the ransomware gang used Exmatter to determine certain file types and upload them to attacker-controlled servers. Subsequently, they implement the ransomware on the compromised networks and encrypt data – with assailants requesting payment for the access key.

Benefits Of New Attack Method

An investigation of the new classification of exmatter used as part of a BlackCat attack deduces that, instead of encrypting data, the exfiltration tool is rather used to obliterate files.

There are numerous reasons why cybercriminals might be sampling with this new tactic. the threat of obliterating data rather than encrypting it could procure an additional incentive for victims of attacks to pay up.

Furthermore, Removing the step of encrypting the data makes the procedure quicker and erases the risk of not getting the full payout, or the victim will find other ways to decrypt the data.