FBI, CISA, NSA share defense tips for BlackMatter ransomware attacks

The Cybersecurity and Infrastructure Security Agency, the Federal Bureau of Investigation, and the National Security Agency published today an advisory with details about how the BlackMatter ransomware gang operates.

The joint cybersecurity advisory from CISA, the FBI, and the NSA shares the tactics, techniques, and procedures associated with BlackMatter activity that could help organizations protect against the BlackMatter ransomware gang.

“Notably, this variant of BlackMatter leverages the embedded credentials and SMB protocol to remotely encrypt, from the original compromised host” – joint advisory from CISA, FBI, and NSA. The BlackMatter file-encrypting malware also has a version for Linux-based systems that can encrypt VMware ESXi virtual servers, which are common in enterprise environments for resource management purposes.

The advisory today warns that, unlike other ransomware actors that encrypt backup data stores and appliances, the BlackMatter gang wipes or reformats them.

To counter BlackMatter ransomware attacks, CISA, the FBI, and the NSA shares a set of cybersecurity measures that start from the basic password hygiene and go to mitigations designed to minimize the Active Directory attack surface.

BlackMatter is among the top ransomware threats today.

Share this article on social media:

Subscribe to Our Newsletter!
Stay on top of cybersecurity risks, evolving threats and industry news.
This field is for validation purposes and should be left unchanged.

The Latest Cybersecurity News

From major cyberattacks, newly discovered critical vulnerabilities to recommended best practices, read it here first:

Tell us About your Needs
Get an Answer the Same Business Day

Got an urgent request? Call us at 1-877-805-7475 or Book a meeting.

What happens next:

A Vumetric expert will contact you to learn more about your cybersecurity needs and goals.

The project's scope will be defined (Target environment, deadlines, requirements, etc.)

A detailed quote including all-inclusive pricing and statement of work is sent to you.

This field is for validation purposes and should be left unchanged.


Everything You Need to Know

Gain confidence in your future cybersecurity assessments by learning to effectively plan, scope and execute projects.


Enter your Email Address

This field is for validation purposes and should be left unchanged.

* No free email provider (e.g: gmail.com, hotmail.com, etc.)

This site is registered on wpml.org as a development site. Switch to a production site key to remove this banner.