BlackCat Adds Brute Ratel to Attack Tools

Research by Sophos Labs has shown that the BlackCat Ransomware attack gangs have now added Brute Ratel to its arsenal of attack tools.

Sophos revealed this through an article dubbed ‘BlackCat Ransomware Attacks Not Merely a Byproduct of Bad Luck’. Brute Ratel is a pentesting tool, its arsenal of attack tools. The article details a string of ransomware attacks in which BlackCat used unpatched or outdated firewalls and VPN services to infiltrate vulnerable networks and systems worldwide across various industries.

BlackCat ransomware first emerged in November 2021 as the self declared newest ‘leader’ in the ransomware-as-a-service business, and quickly drew attention for its unusual coding language, Rust.

As soon as December 2021, targeted organizations called in Sophos Rapid Response to investigate at least five attacks involving BlackCat. In four of these incidents, the initial infection occurred by exploiting vulnerabilities in different firewall vendors’ products. One of these vulnerabilities in different firewall vendors’ products.

One of these vulnerabilities was from 2018 and another emerged last year. Once inside the network, the attackers were able to obtain VPN credentials stored on these firewalls to log in as authorized users and then move laterally throughout the systems using remote desktop protocol (RDP).

As seen in prior BlackCat incidents, the attackers also leveraged open source and commercially available tools to create additional backdoors and alternative pathways for remote access to targeted systems. These included TeamViewer, nGrok, Cobalt Strike, and Brute Ratel.

“What we’re seeing with BlackCat and other attacks recently is that threat actors are very efficient and effective in their work. They use tried and true methods, like attacking vulnerable firewalls and VPNs, because they know these still work. But they show innovation to avoid security defenses, like switching to the newer post-exploitation C2 framework Brute Ratel in their attacks,” said Christopher Budd, senior manager, threat research, Sophos.

There was no clear pattern to the attacks; they occurred across the U.S., Europe, and Asia at large corporations operating in different industry segments. However, the targeted companies did share certain environmental vulnerabilities that simplified the attackers’ work, including outdated systems that could no longer be updated with the latest security patches, a lack of multifactor authentication for VPNs, and flat networks (where every machine can see every other machine in the network).

“The common denominator with all these attacks is that they were easy to carry out. In one instance, the same BlackCat attackers installed cryptominers a month before launching the ransomware. This latest research highlights how important it is to follow established best security practices; they still have a lot of power to prevent and thwart attacks, including multiple attacks against a single network.”

To learn more about the string of BlackCat attacks, read “BlackCat Ransomware Attacks Not Merely a Byproduct of Bad Luck” on Sophos.com.

Sophos experts have also put together an nGrok Incident Response Guide to help security teams prevent attackers from abusing the nGrok tool on their network.