Austria hit by BlackCat Ransomware, which demands $5 Million

The Austrian Federal State, Carinthia was attacked on Tuesday and Government services were severely disrupted as more workstations were apparently locked by the attacker.

BlackCat, also called as ALPHV, a rebrand of the DarkSide / BlackMatter group, is one of the sophisticated ransomware operations. The ransomware executable is highly customizable, with different encryption methods and options allowing for attacks on a wide range of corporate environments.

The group demands $5 Million to unlock the encrypted systems, which involves most workstations in the Austrian State.

Follow us for more, Facebook, Twitter, LinkedIn and Instagram

Carinthia’s website and email services are currently offline. Thus the administration is unable to issue new passports or traffic fines too. According to the Spokesperson, Gerd Kurath, this could continue for another few days.

 Moreover, the attack had also disrupted the COVID test processing and contact tracing done through the administrative offices.

As no evidence had been spotted that the data breach was a success. None of the usual teaser posts in the group’s dumpsite pose as evidence either. The spokesperson confirmed that there is no intention of paying the ransom.

The Spokesperson further clarified that from the assumedly affected 3000 workstations, the first would be available again by last Friday.

According to BleepingComputer, “FBI published a warning that the BlackCat had breached at least 60 entities worldwide, assuming the status it was anticipated to attain as one of the most active and dangerous ransomware projects out there.”

INDICATORS OF COMPROMISE

PowerShell Scripts

Additional PowerShell Filenames

• [###].ps1
• CME.ps1
• [#].ps1
• Run1.ps1
• mim.ps1
• [##].ps1
• psexec.ps1
• Systems.ps1
• System.ps1

Batch Scripts

Executables and DLLs

Additional Observed Filenames

• test.exe
• xxx.exe
• Mim.exe
• xxxw.exe
• crackmapexec.exe
• Services.exe
• plink.exe
• Systems.exe
• PsExec64.exe

BlackCat Ransomware SHA256 Hashes

• 731adcf2d7fb61a8335e23dbee2436249e5d5753977ec465754c6b699e9bf161
• f837f1cd60e9941aa60f7be50a8f2aaaac380f560db8ee001408f35c1b7a97cb
• 731adcf2d7fb61a8335e23dbee2436249e5d5753977ec465754c6b699e9bf161
• 80dd44226f60ba5403745ba9d18490eb8ca12dbc9be0a317dd2b692ec041da28

C2 IPs

In recent months, administrations across Europe have been repeatedly attacked with ransomware and other malware. And so, we suggest all the organizations to update their securities and take additional steps towards protecting your data to avoid these kinds of attacks.