No Bad Luck for Darktrace: Combatting ALPHV BlackCat Ransomware | Darktrace Blog

MITRE Techniques

• [T1583.008] Acquire Infrastructure – Malvertising was used to provision infrastructure and lure victims (‘malvertising’ to deliver a Python-based backdoor-dropper known as ‘Nitrogen’).
• [T1189] Drive-by Compromise – Users were redirected by sponsored search results to a spoofed download site, resulting in an unintended malware download (‘redirected to the website, wireshhark[.]com … users unintentionally installed a malware sample’).
• [T1204.002] User Execution: Malicious File – The attack relied on user-initiated downloads/execution of malicious installers from an impersonation site (‘Users’ attempts to download software … resulted in the delivery of a backdoor-dropping malware sample dubbed ‘Nitrogen”).
• [T1569.002] System Services: Service Execution – The adversary used service/execution mechanisms to run delivered payloads and tools across systems (‘distributing the Windows Sys-Internals tool, PsExec, likely in an attempt to facilitate their lateral movement’).
• [T1047] Windows Management Instrumentation – WMI was used to distribute Python payloads and execute actions remotely (‘abuse the privileged account credentials to spread Python payloads across the network via SMB and the Windows Management Instrumentation (WMI) service’).
• [T1036.005] Masquerading: Match Legitimate Name or Location – Executables were disguised to resemble legitimate files to evade detection (‘executable files being distributed were attempting to masquerade as a different file type’).
• [T1018] Remote System Discovery – The attacker performed discovery of remote systems to identify targets for lateral movement (‘identified the attacker moving laterally to an internal SQL server and an internal domain controller’).
• [T1046] Network Service Discovery – The adversary conducted network/port scanning to map services (‘conduct network reconnaissance (primarily port scanning)’).
• [T1021.002] Remote Services: SMB/Windows Admin Shares – SMB was used to transfer payloads and propagate across the environment (‘spread Python payloads across the network via SMB’).
• [T1570] Lateral Tool Transfer – Tools and payloads (Python executables, PsExec) were transferred between hosts to enable lateral movement (‘distributing the Windows Sys-Internals tool, PsExec … distribute Python payloads to an internal domain controller’).
• [T1071.001] Application Layer Protocol: Web Protocols – C2 communication occurred over HTTPS/SSL to web endpoints (‘C2 connections were made over SSL on ports 443 and 8443’).
• [T1573.002] Encrypted Channel: Asymmetric Cryptography – Encrypted C2 channels were used for command and control communications (C2 over SSL and likely asymmetric crypto was referenced in MITRE mapping).
• [T1571] Non-Standard Port – C2 used ports beyond typical expectations (noted use of 8443 alongside 443 for SSL C2 connections).
• [T1105] Ingress Tool Transfer – The attacker transferred additional payloads from external sources into the network (transfer of a payload from GitHub to the domain controller: ‘transfer a payload from GitHub to the domain controller’).
• [T1041] Exfiltration Over C2 Channel – Data was exfiltrated to the attacker over established C2 connections (‘exfiltrate data from the domain controller’).
• [T1486] Data Encrypted for Impact – The adversary detonated ransomware to encrypt VMware vCenter and virtual machines (‘detonating ransomware with the organization’s VMware environment … encryption of the customer’s VMware vCenter server and VMware virtual machines’).