AttackIQ summarized and emulated the TTPs and IOCs from CISA AA23-353A for the ALPHV/BlackCat RaaS, providing an attack graph to validate defenses. The emulation covers discovery, LSASS credential dumping and Mimikatz usage, lateral movement (BITSAdmin, RDP), C2 via Cobalt Strike/SystemBC, process injection, and final encryption and cleanup. #ALPHV #BlackCat #AttackIQ #CISA #FBI
Keypoints
- CISA AA23-353A and FBI findings detail TTPs and IOCs associated with the ALPHV/BlackCat RaaS.
- AttackIQ produced an emulation (attack graph) that reproduces BlackCat behaviors across four stages: discovery, credential access, C2/payload delivery, and impact (encryption/cleanup).
- Credential harvesting techniques include LSASS memory dumping (minidump) and use of an obfuscated Mimikatz; lateral movement uses BITSAdmin, RDP, and remote execution tools.
- Adversaries deploy Cobalt Strike beacons or SystemBC (Coroxy) for C2, transfer tools with BITS jobs or Ingress Tool Transfer, and perform process injection to execute payloads.
- Final-stage actions include collecting Windows UUID via WMI, modifying LanmanServer registry values, deleting Volume Shadow Copies (vssadmin), clearing Windows Event Logs (wevtutil), and encrypting files in place.
- AttackIQ recommends prioritizing detection and mitigation for process injection and inhibit-system-recovery techniques and following CISA’s patching/detection guidance.
- The AttackIQ assessment template lets defenders validate controls against BlackCat-like playbooks and improve incident response readiness.
MITRE Techniques
- [T1087] Account Discovery – Enumerates accounts available on the system via WMI (‘…enumerates accounts available on the system through Windows Management Instrumentation (WMI).’)
- [T1069.001] Permission Groups Discovery: Local Groups – Uses net localgroup and net group /domain to enumerate local and domain groups (‘…executes net localgroup and net group /domain to enumerate local system groups.’)
- [T1106] Native API – Collects user SID via LookupAccountNameW Windows API call (‘…collects the User Security Identifier (SID) via the LookupAccountNameW Windows API call.’)
- [T1083] File and Directory Discovery – Uses dir to find files of interest and outputs to a temporary file (‘…uses the native dir command to find files of interest and output to a temporary file.’)
- [T1057] Process Discovery – Lists running processes through WMI (‘…Running processes are listed through Windows Management Instrumentation (WMI).’)
- [T1016] System Network Configuration Discovery – Runs route, ipconfig, and net use to collect host and network share details (‘…native Windows commands like route, ipconfig, and net use are executed to collect details about the infected host and network shares.’)
- [T1049] System Network Connections Discovery – Uses netstat to collect active connections and listening services (‘…the native Windows command line tool netstat is used to collect active connections and any listening services running on the host.’)
- [T1018] Remote System Discovery – Leverages Adfind (and Nmap) to collect Active Directory info and scan the local network (‘…will leverage the Adfind utility to collect information related to the Active Directory.’ / ‘Nmap is used to scan the local network…’)
- [T1135] Network Share Discovery – Discovers network shares through the NetShareEnum API call (‘…discover network shares through the NetShareEnum API call.’)
- [T1003.001] OS Credential Dumping: LSASS Memory – Dumps LSASS to disk by creating a minidump of the lsass process (‘…LSASS memory is dumped to disk by creating a minidump of the lsass process.’)
- [T1003] OS Credential Dumping – Uses an obfuscated version of Mimikatz to dump credentials (‘…uses an obfuscated version of Mimikatz to dump credentials on Windows hosts.’)
- [T1197] BITS Jobs – Uses bitsadmin to create BITS jobs to download remote payloads (‘…commands are executed using bitsadmin to create a BITS job and configure it to download a remote payload.’)
- [T1021.001] Remote Services: RDP – Uses Remote Desktop Protocol to move laterally with stolen credentials (‘…attempts to remotely connect to another accessible asset with stolen credentials.’)
- [T1105] Ingress Tool Transfer – Downloads payloads to memory and disk to test prevention of delivery (‘…downloads to memory and saves to disk in independent scenarios to test network and endpoint controls…’)
- [T1055] Process Injection – Injects a DLL into another running process and validates execution (‘…injects a DLL file into another running process and validates if a canary file can be created.’)
- [T1047] Windows Management Instrumentation – Collects Windows UUID via WMI (‘…collect the Windows Universally Unique Identifier (UUID) by executing the csproduct get UUID command.’)
- [T1112] Modify Registry – Changes LanmanServer MaxMpxCt registry value to alter Server Service behavior (‘…the HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesLanmanServerParameters MaxMpxCt registry value is modified…’)
- [T1490] Inhibit System Recovery – Uses vssadmin and WMI to delete Volume Shadow Copies (‘…uses vssadmin.exe and WMI Objects to delete a recent Volume Shadow Copy…’)
- [T1070.001] Indicator Removal: Clear Windows Event Logs – Uses wevtutil.exe to clear event logs (‘…use the wevtutil.exe binary to clear event logs from the system.’)
- [T1486] Data Encrypted for Impact – Performs file encryption on matching extensions using BlackCat-observed algorithms (‘…performs the file encryption routines used by common ransomware families…Files matching an extension list are identified and encrypted in place…’)
Indicators of Compromise
- [Process / Executable] tools and binaries observed – lsass.exe (minidump of lsass), wevtutil.exe, vssadmin.exe, and other system binaries referenced
- [Offensive Tools] attacker tooling – Mimikatz (obfuscated), Cobalt Strike Beacon, SystemBC (Coroxy), and other tools like Adfind and Nmap
- [Download/Transfer Mechanisms] delivery utilities – bitsadmin usage to create BITS jobs for payload download, Ingress Tool Transfer activity
- [Commands / Registry] configuration and commands – ‘csproduct get UUID’ (WMI), ‘vssadmin Delete Shadows’ command example, and registry path HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesLanmanServerParametersMaxMpxCt
- [Network / Protocols] lateral movement and C2 channels – RDP connections for lateral access, Cobalt Strike/SystemBC C2 beacons (no explicit IPs/domains listed in article)
Attack flow (technical procedure):
Attackers begin with broad environment discovery using WMI and native commands to enumerate accounts, groups, processes, files, network configuration and shares (e.g., WMI account enumeration, net localgroup / net group /domain, LookupAccountNameW, dir, ipconfig/route/net use, netstat, Adfind/Nmap, NetShareEnum). They target credential sources by dumping LSASS memory (creating an lsass minidump) and running an obfuscated Mimikatz to extract credentials.
With harvested credentials, the adversary moves laterally and stages tools: they create BITS jobs via bitsadmin to download additional payloads, scan for remote hosts with Nmap/Adfind, and use stolen credentials to access systems over RDP. For persistent C2 and remote control they deploy Cobalt Strike beacons or, if that fails, SystemBC (Coroxy); payloads may be delivered via Ingress Tool Transfer and saved to disk or run in memory.
In the final impact stage the actor injects a DLL into a running process to execute ransomware, collects the Windows UUID via WMI (csproduct get UUID), modifies LanmanServer registry values, deletes Volume Shadow Copies with vssadmin, clears event logs with wevtutil, and encrypts files in place using algorithms and extension lists observed in BlackCat operations.
Read more: https://www.attackiq.com/2023/12/29/response-to-cisa-advisory-aa23-353a/