BlackMatter Ransomware Attacks Threaten Healthcare, HC3 Says

BlackMatter’s Origins

HC3 stated that the group likely originated in Eastern Europe and is Russian-speaking. The group has targeted victims in the United States, Brazil, Chile, India, and Thailand so far. BlackMatter has focused on the real estate, IT services, food and beverage, architecture, education, and finance sectors.

The group claimed that it would not target hospitals, critical infrastructure facilities, nonprofit companies, government, the defense industry, or the oil and gas industry. However, the brief noted that “These details are what BlackMatter claims to be, and may not be accurate.”

The brief also suggested that BlackMatter may be the latest successor of DarkSide and REvil/Sodinokibi. Technical analysis revealed “an obvious connection between BlackMatter and DarkSide and REvil samples,” the brief stated.

As a result, the healthcare sector should remain on high alert. 

DarkSide claimed responsibility for the cyberattack on US critical infrastructure entity Colonial Pipeline in May, which resulted in supply chain disruptions and motivated President Biden to sign an executive order on improving cybersecurity nationwide. 

REvil/Sodinokibi deployed ransomware on US meat supplier JBS in May and IT management software company Kaseya in July, resulting in more supply chain disruptions and widespread concern. The group also claimed responsibility for a cyberattack on University Medical Center of Southern Nevada that compromised the personal data of over 1.3 million individuals.

REvil/Sodinokibi took its infrastructure and websites offline on July 12, 2021. On July 19, a user account with the alias “BlackMatter” was registered on the forum. On July 21, a spokesperson for the group announced its new ransomware on high tier hacking forums.

By August 11, BlackMatter began announcing its first victims on its data leak and extortion blog.

Tactics and Goals

Black Matter appears to be strictly financially motivated, according to its website and interviews. In screenshots from the group’s website added to the brief, BlackMatter states: “We are a team that unites people according to one common interest – money.”

“We provide the best service for our clients and partners compared to our competitors. We rely on honesty and transparency in our dealings with our victims. We never attack the company twice and always fulfill our obligations.”

BlackMatter said that it prefers to target organizations with over $100 million in revenue, but HC3 found that most of its victims so far have not reached its revenue criteria.

The group uses ransomware written in C and typically targets Windows and Linux servers. HC3 identified the group as a “highly-sophisticated, financially-motivated cybercriminal operation.”

BlackMatter is actively searching for initial access brokers (IABs), individuals who serve as a middleman by selling access to compromised networks to ransomware groups for further exploitation. IABs typically play a major part in the success of ransomware operations.

IABs sell credentials, VPN login information, and web shells to ransomware groups.

“HC3 has observed at least 65 instances of threat actors selling network access to healthcare entities on hacking forums in the past year,” the brief warned.

BlackMatter usually attempts to mount and encrypt unmounted partitions, target locally stored files, and terminate processes before encryption. In addition, the ransomware code can be configured to upload system information to a remote server using HTTP or HTTPS.

Mitigation strategies

“While there have not been any public healthcare victims yet, BlackMatter’s suspected predecessors targeted the healthcare sector,” the brief maintained.

“HPH organizations should remain on alert despite the group’s claims to not target healthcare.”

HC3 recommended that organizations maintain offline, encrypted data backups and engage in regular testing. The brief also suggested that organizations maintain a cyber incident response plan, communications plan, and resiliency plan.

It is crucial that healthcare organizations practice good cyber hygiene, train employees to recognize phishing emails, and work on patching known vulnerabilities and misconfigurations in order to avoid becoming the group’s next victim.