Cyber Criminals Are Increasingly Targeting Industrial Companies
Malicious cyber attackers pose serious threat to Europe’s industrial infrastructure.
A tool used by the ransomware group known as BlackCat, ALPHV and Noberus, suggests cybercriminals are increasingly targeting industrial companies. BlackCat, which operates under a Ransomware-as-a-Service (RaaS) model, emerged in November 2021. Ever since it has targeted businesses worldwide. In a report published in February, industrial cybersecurity specialist Claroty said ransomware often attacks industrial control systems (ICS) or other operational technology (OT) environments, often with a significant impact.
Links between BlackCat, BlackMatter and DarkSide
Several cybersecurity firms have identified links between BlackCat and the ransomware activities of BlackMatter and DarkSide. It appears that the BlackCat team is made up of various members of the RaaS group, including BlackMatter, and that it is not a rebrand of BlackMatter.
Symantec describes the Fendr data exfiltration tool as a custom tool that BlackMatter operators were able to use to easily steal valuable data from compromised systems. So far, the tool has only been used in BlackMatter attacks. It was designed to collect specific file types and upload them to the cybercriminals’ servers before using the ransomware to encrypt files. The stolen data can then be used to force the victim to pay.
Governments warn of increasing threat to industrial systems
In a recent BlackCat attack on an oil, gas, mining and construction company in South America, the hackers used a version of the Fendr tool. However, compared to the tool discovered in BlackMatter attacks, this attack targeted some additional file types, particularly those typically found in industrial environments. The fact that a ransomware gang is interested in industrial companies is not surprising. Governments as well as cybersecurity companies have warned organisations that ransomware poses an increasing threat to industrial systems.
