HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Alert Issued About Ongoing BlackMatter Ransomware Attacks

A joint alert has been issued by the Federal Bureau of Investigation (FBI), National Security Agency (NSA), and the Cybersecurity and Infrastructure Security Agency (CISA) about ongoing BlackMatter ransomware attacks.

The group has been conducting attacks in the United States since July 2021, which have included attacks on critical infrastructure entities and two organizations in the U.S. Food and Agriculture Sector. Evidence has been obtained that links the gang to the DarkSide ransomware gang that conducted attacks between September 2020 and May 2021, including the attack on Colonial Pipeline, with BlackMatter ransomware potentially a rebrand of the DarkSide operation.

Investigations into the attacks have allowed the agencies to obtain important information about the tactics, techniques, and procedures (TTPs) of the group, and an analysis has been performed on a sample of the ransomware in a sandbox environment.

The group is known to use previously compromised credentials to gain access to victims’ networks, then leverages the Lightweight Directory Access Protocol (LDAP) and Server Message Block (SMB) protocol to access the Active Directory (AD) and discover all hosts on the network. The BlackMatter gang deploys ransomware and remotely encrypts the hosts and shared drives as they are identified. The gang is known to exfiltrate data and typically demands ransom payments of between $80,000 and $15 million in Bitcoin or Monero.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

In the joint alert, the NSA, FBI, and CISA shared TTPs, provide Snort signatures that can be used for detecting the network activity associated with BlackMatter ransomware attacks, and several mitigations to reduce the risk of a compromise by the gang.

Mitigations include:

  • Implementing detection signatures to identify and block attacks in progress
  • Using strong passwords resistant to brute force attacks
  • Implementing multi-factor authentication to block the use of stolen credentials
  • Patching and updating systems promptly
  • Limiting access to resources over networks
  • Implementing network segmentation and traversal monitoring
  • Using admin disabling tools to support identity and privileged access management
  • Implementing and enforcing backup and restoration policies and procedures

The alert, TTPs, and mitigations can be found here.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.