An analysis of two ransomware attacks has identified overlaps in the tactics, techniques, and procedures (TTPs) between BlackCat and BlackMatter, indicating a strong connection between the two groups.
While it’s typical of ransomware groups to rebrand their operations in response to increased visibility into their attacks, BlackCat (aka Alphv) marks a new frontier in that the cybercrime cartel is built out of affiliates of other ransomware-as-a-service (RaaS) operations.
BlackCat first emerged in November 2021 and has since targeted several organizations worldwide over the past few months. It has been called out for being similar to BlackMatter, a short-lived ransomware family that originated from DarkSide, which attracted notoriety for its high-profile attack on Colonial Pipeline in May 2021.
In an interview with Recorded Future’s The Record last month, a BlackCat representative dismissed speculations that it’s a rebranding of BlackMatter while noting that it’s made up of affiliates associated with other RaaS groups.
“In part, we are all connected to gandrevil [GandCrab / REvil], blackside [BlackMatter / DarkSide], mazegreggor [Maze / Egregor], lockbit, etc., because we are adverts (aka affiliates),” the unnamed representative was quoted as saying. “We borrowed their advantages and eliminated their disadvantages.” Read more: https://bit.ly/3qmGXTE