BlackMatter Ransomware: In-Depth Analysis, Detection, and Mitigation

What is BlackMatter Ransomware?

BlackMatter appeared on the ransomware scene in July 2021 with their interest in purchasing “Network Access to Businesses in the US, Canada, Australia, and Great Britain” from a well-known cybercrime market. Additionally, BlackMatter also functions as a RaaS. BlackMatter ransomware is an evolution of DarkSide, both related to BlackCat/ALPHV.

The group behind BlackMatter maintains a TOR-based blog that tracks leaked data from victims who have not paid the ransom. This is part of a double extortion technique. First, victims have the added pressure of a potential leak of sensitive files on top of their systems being disabled by ransomware. There are both Windows and Linux variations of BlackMatter. There are BlackMatter variants for Windows and Linux.

What Does BlackMatter Ransomware Target?

BlackMatter ransomware targets many industries, including healthcare, telecom, banking, finance, education, government, and other critical infrastructure. Additionally, it has been targeting various organizations, including hospitals, universities, large enterprises, and small businesses.

How Does BlackMatter Ransomware Work?

BlackMatter ransomware is often distributed via phishing emails. Cobalt Strike and COTS management and monitoring software have also been observed. BlackMatter campaigns have also been linked to exploiting LDAP and SMB vulnerabilities.

BlackMatter Ransomware Technical Details

Current versions of BlackMatter exist for both Windows and Linux operating systems. However, the malware is highly obfuscated and employs numerous anti-analysis techniques. In addition, the authors have enhanced the ransomware with advanced features, such as the ability to infect systems even when in safe mode, thus circumventing certain antivirus products.

BlackMatter only partially encrypts files, a feature it shares with other ransomware families. Partially encrypting files allows the ransomware to run through the system much more quickly. The encrypting that does occur is accomplished via a combination of Salsa20 and RSA-1024. By modifying a more minor part of the file contents in less time, the attackers hope to operate under the threshold of what security products consider malicious and thus increase their stealth.

In addition, BlackMatter can infect available network resources and Network Attached Storage (NAS) devices. Network discovery and enumeration is handled via embedded, previously-harvested credential sets.

How to Detect BlackMatter Ransomware

  • The SentinelOne Singularity XDR Platform can identify and stop any malicious activities and items related to BlackMatter.

The SentinelOne Singularity XDR Platform identifies and stops any malicious activities and items related to BlackMatter.

In case you do not have SentinelOne deployed, detecting ransomware requires a combination of technical and operational measures designed to identify and flag suspicious activity on the network. This allows the organization to take appropriate action, and to prevent or mitigate the impact of the ransomware attack.

To detect BlackMatter Ransomware without SentinelOne deployed, it is vital to take a multi-layered approach, which includes the following steps:

  1. Use anti-malware software or other security tools to detect and block known ransomware variants. These tools may use signatures, heuristics, or machine learning algorithms, to identify and block suspicious files or activities.
  2. Monitor network traffic and look for indicators of compromise, such as unusual network traffic patterns or communication with known command-and-control servers.
  3. Conduct regular security audits and assessments to identify network and system vulnerabilities and ensure that all security controls are properly functioning.
  4. Educate and train employees on cybersecurity best practices, including identifying and reporting suspicious emails or other threats.
  5. Implement a robust backup and recovery plan to ensure that the organization has a copy of its data and can restore it in case of an attack.

How to Mitigate BlackMatter Ransomware

  • The SentinelOne Singularity XDR Platform can return systems to their original state using either the Repair or Rollback feature.

If you do not have SentinelOne deployed, there are several steps that organizations can take to mitigate the risk of Ryuk ransomware attacks.

Educate Employees

Employees should be educated on the risks of ransomware, and on how to identify and avoid phishing emails, malicious attachments, and other threats. They should be encouraged to report suspicious emails or attachments, and to avoid opening them, or clicking on links or buttons in them.

Implement Strong Passwords

Organizations should implement strong, unique passwords for all user accounts, and should regularly update and rotate these passwords. Passwords should be at least 8 characters long, and should include a combination of uppercase and lowercase letters, numbers, and special characters.

Enable Multi-factor Authentication

Organizations should enable multi-factor authentication (MFA) for all user accounts, to provide an additional layer of security. This can be done through the use of mobile apps, such as Google Authenticator or Microsoft Authenticator, or through the use of physical tokens or smart cards.

Update and Patch Systems

Organizations should regularly update and patch their systems, to fix any known vulnerabilities, and to prevent attackers from exploiting them. This includes updating the operating system, applications, and firmware on all devices, as well as disabling any unnecessary or unused services or protocols.

Implement Backup and Disaster Recovery

Organizations should implement regular backup and disaster recovery (BDR) processes, to ensure that they can recover from ransomware attacks, or other disasters. This includes creating regular backups of all data and systems, and storing these backups in a secure, offsite location.

The backups should be tested regularly, to ensure that they are working, and that they can be restored quickly and easily.

Purpose Built to Prevent Tomorrow’s Threats. Today.
Your most sensitive data lives on the endpoint and in the cloud. Protect what matters most from cyberattacks. Fortify every edge of the network with realtime autonomous protection.