{"id":7851,"date":"2024-07-21T17:52:00","date_gmt":"2024-07-21T17:52:00","guid":{"rendered":"https:\/\/cybersecuritynews.com\/?p=7851"},"modified":"2024-08-13T11:15:14","modified_gmt":"2024-08-13T11:15:14","slug":"blackmatter-ransomware-that-leverages-smb-ldap-ad","status":"publish","type":"post","link":"https:\/\/cybersecuritynews.com\/blackmatter-ransomware-that-leverages-smb-ldap-ad\/","title":{"rendered":"CISA, NSA, FBI Released Advisory with TTPs For BlackMatter Ransomware That leverages SMB, LDAP, AD"},"content":{"rendered":"\n

CISA, NSA, FBI have recently released a joint advisory <\/a>report with TTPs for BlackMatter ransomware that primarily leverages the SMB (Server Message Block), light directory access protocol (LDAP)<\/a>, and AD <\/a>(Active Directory) to identify all the available hosts on the network.\u00a0<\/p>\n\n\n\n

While the BlackMatter ransomware was targeting several critical infrastructure entities in the U.S. since July 2021, and this includes two major Food and Agriculture Sector organizations.<\/p>\n\n\n\n

CISA, the FBI, and NSA urge all organizations to immediately apply all the recommended mitigations, since, the attacks of this ransomware directly affect consumer access to critical infrastructure services.<\/p>\n\n\n\n

TTPs of BlackMatter Ransomware<\/strong><\/h2>\n\n\n\n

The user credentials that were previously compromised, NtQuerySystemInformation, and EnumServicesStatusExW were exploited by the BlackMatter ransomware to list all the running processes and services.<\/p>\n\n\n\n

To discover all the hosts in the Active Directory BlackMatter exploits the embedded credentials in the LDAP and SMB protocol. And to identify each host for accessible shares it uses the srvsvc.NetShareEnumAll Microsoft Remote Procedure Call (MSRPC) function.<\/p>\n\n\n\n

From the original compromised host, BlackMatter remotely encrypts the shares\u2019 contents like ADMIN$, C$, SYSVOL, and NETLOGON by leveraging the embedded credentials and SMB protocol.<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Mitigations<\/strong><\/h2>\n\n\n\n

Here are the recommended mitigations offered by CISA, the FBI, and NSA mentioned below:-<\/p>\n\n\n\n