At least one subsidiary of high-profile ransomware-as-a-service (RaaS) group BlackByte is using a custom tool to exfiltrate files from a victim’s network, a key step in the fast-growing double racketeering business.
The exfiltration tool, dubbed Exbyte, is written in Go for Windows computers and is designed to upload files to cloud storage service Mega, researchers from Symantec’s Threat Hunter team said this month.
Exbyte allows the partner to quickly grab a victim’s sensitive internal documents and stash them out of sight, another indication of BlackByte’s growing status in the ever-evolving ransomware world. A victim’s network is compromised and the intruders siphon data with Exbyte and then lock down the network with BlackByte.
“Following the demise of a number of large ransomware operations such as Conti and Sodinokibi [also known as REvil]BlackByte has emerged as one of the ransomware players capitalizing on this gap in the market,” the Symantec team wrote in a report on its way to becoming one of the dominant ransomware threats.”
BlackByte was formed in July 2021 and quickly became a significant group in the RaaS space. The US government’s Cybersecurity and Infrastructure Security Agency (CISA) and the FBI issued an alert in February [PDF]and found that the ransomware was used multiple times to target US and foreign companies, including at least three organizations in critical infrastructure sectors — government, finance, and food and agriculture — in the United States.
The BlackByte group was also behind an attack on the San Francisco 49ers soccer team in February.
Symantec says that the BlackByte RaaS operation is run by a crew called Hecamede and that the ransomware has been among the most used in attacks in recent months. Trend Micro noted in a report that BlackByte operators not only allow affiliates to use their malware directly, but also use it to launch their own attacks.
As RaaS, BlackByte and its back-end infrastructure are essentially rented out to criminals for use, with the Windows malware operators clipping any ill-gotten gains from using their code.
Like a growing number of other ransomware gangs, BlackByte and its affiliates are caught up in the data extortion butterfly, stealing data and threatening to leak it publicly or even delete it if victims don’t make the required payment.
Exbyte is not just a custom data exfiltration tool. Symantec researchers pointed out the Exmatter file stealer discovered in November 2021 and used by the BlackMatter ransomware gang and later in Noberus ransomware attacks. There is also Ryuk Stealer and StealBit which they said is linked to LockBit.
Some groups like Karakurt skip the encryption step entirely and go straight to data exfiltration and extortion. The trend towards pure blackmail is increasing as threat groups avoid the cumbersome programming and cryptography required to encrypt and decrypt a victim’s files with keys stored on remote backend servers and opt for simple data collection.
Once executed, Exbyte performs a series of checks to ensure it is not in a sandbox environment to make it more difficult for security teams to analyze the malware. It also looks for running processes of eight applications and antivirus or sandbox related files.
Such checks are similar to those performed by the BlackByte ransomware payload itself, Sophos researchers outlined in a report earlier this year.
The tool then grabs document files on the compromised system and exfiltrates the files by uploading them to a folder created by the malware on Mega, with Mega account credentials hardcoded to Exbyte. See the Symantec report for technical details on detection.
In recent BlackByte infections, criminals have exploited ProxyShell and ProxyLogon vulnerabilities in Microsoft Exchange servers, using tools like AdFind, AnyDesk, NetScan, and PowerView to move through a network before or while deploying the file-encrypting ransomware payload . They also use version 2.0 of the BlackByte ransomware in more recent attacks. ®
https://www.theregister.com/2022/10/24/blackbyte_ransomware_exbyte_extortion/ Ransomware partner BlackByte also steals victims’ data • The Register