BlackMatter Ransomware | CISA

[Firefox]

This advisory provides information on cyber actor tactics, techniques, and procedures (TTPs) obtained from a sample of BlackMatter ransomware analyzed in a sandbox environment as well from trusted third-party reporting. Using embedded, previously compromised credentials, BlackMatter leverages the Lightweight Directory Access Protocol (LDAP) and Server Message Block (SMB) protocol to access the Active Directory (AD) to discover all hosts on the network. BlackMatter then remotely encrypts the hosts and shared drives as they are found.

Source: https://us-cert.cisa.gov/ncas/alerts/aa21-291a

[David H. Lipman]

Mitigations

amongst others...

Quote

Limit Access to Resources over the Network

• Remove unnecessary access to administrative shares, especially ADMIN$ and C$. If ADMIN$ and C$ are deemed operationally necessary, restrict privileges to only the necessary service or user accounts and perform continuous monitoring for anomalous activity.
• Use a host-based firewall to only allow connections to administrative shares via SMB from a limited set of administrator machines.