BlackCat Ransomware Exploits WinSCP Search Ads to Distribute Cobalt Strike: A Comprehensive Analysis

In a recent alarming development, the BlackCat ransomware group, also known as ALPHV, has taken advantage of malvertizing campaigns to deceive unsuspecting users. By utilizing search ads, they entice individuals into visiting counterfeit pages that closely mimic the official website of WinSCP, a widely-used file-transfer application for Windows. However, instead of providing legitimate installers, these fraudulent pages distribute files infected with malware. This article delves into the tactics employed by the BlackCat ransomware group, sheds light on the potential risks faced by system administrators and IT professionals, and reveals the subsequent stages of the attack.

1. Exploiting the Popularity of WinSCP:
WinSCP (Windows Secure Copy) is a highly regarded, free, and open-source file-transfer application for Windows. It offers secure file transfer functionality using various protocols such as SFTP (SSH File Transfer Protocol), FTP (File Transfer Protocol), SCP (Secure Copy Protocol), and Amazon S3. Apart from its file transfer capabilities, WinSCP functions as a file manager, allowing users to navigate and manage files on remote servers or cloud storage. Renowned for its user-friendly interface, encryption capabilities, and support for automation and scripting, WinSCP has gained immense popularity among system administrators, web admins, and IT professionals. Recognizing this, the BlackCat ransomware group has exploited the application's reputation to gain initial access to valuable corporate networks.

2. The Deceptive Strategy:
To carry out their nefarious activities, BlackCat ransomware operators have initiated ad campaigns on major search engines, including Google and Bing. When users search for "WinSCP Download," the manipulated search results display malicious links that are given priority over the legitimate WinSCP download sites. Unsuspecting victims, oblivious to the risks involved, click on these ads and are directed to websites posing as tutorials on automated file transfers using WinSCP. These deceptive sites have been meticulously designed to evade detection by Google's anti-abuse crawlers.

3. Cloned Websites and Malware Distribution:
Upon reaching the counterfeit tutorial sites, victims come across clone websites that closely mimic the official WinSCP website. These clones employ domain names that bear a striking resemblance to the legitimate winscp.net domain, such as winsccp[.]com. In order to deceive users into downloading malware, the clone websites present a download button. Upon clicking the button, an ISO file containing "setup.exe" and "msi.dll" is downloaded. While "setup.exe" serves as a decoy to entice users, "msi.dll" acts as the malware dropper, triggered by the executable.

4. Execution and Malicious Payload:
Once the victim executes "setup.exe," it invokes "msi.dll" to extract a Python folder from the DLL RCDATA section. This folder masquerades as a genuine WinSCP installer and is intended to be installed on the victim's machine. Furthermore, the installation process includes a trojanized python310.dll file and establishes a persistence mechanism by creating a run key named "Python" with the value "C:\Users\Public\Music\python\pythonw.exe." The executable pythonw.exe loads an obfuscated and modified python310.dll, which contains a Cobalt Strike beacon that establishes a connection with a command-and-control server.

5. Advanced Tools and Lateral Movement:
Having gained a foothold through the Cobalt Strike beacon, the BlackCat ransomware group proceeds with their malicious activities. Trend Micro's analysts have identified the usage of various tools and techniques during the subsequent attack phases:

• AdFind: A command-line tool utilized to retrieve information from Active Directory (AD).
• PowerShell commands: Employed for data gathering, ZIP file extraction , and script execution.
• Python scripts: Used to assess and examine user and group permissions through AccessChk64.
• Findstr: Utilized for searching passwords within XML files.
• PowerView: A PowerSploit script used for Active Directory reconnaissance and enumeration.
• Python scripts: Employed to retrieve passwords and acquire Veeam credentials using the LaZagne tool.
• PsExec, BitsAdmin, and Curl: Tools used for navigating and moving within compromised networks.
• AnyDesk: A legitimate remote management tool manipulated by attackers to ensure their continued access and control over compromised systems.
• KillAV BAT script: Designed to disable or bypass antivirus and antimalware programs.
• PuTTY Secure Copy client: Used for exfiltrating collected information from compromised systems.

These advanced tools and techniques allow the BlackCat ransomware group to perform lateral movement within the compromised network, gather sensitive information, escalate privileges, and maintain persistence, thereby enabling them to carry out their malicious objectives effectively.

It is crucial for system administrators, IT professionals, and users to remain vigilant and take proactive measures to protect their systems from such attacks. Implementing robust security measures, keeping software and applications up to date with the latest patches, and regularly educating users about potential risks and safe browsing practices are essential steps in mitigating the threat posed by the BlackCat ransomware group and similar malicious actors.

In conclusion, the BlackCat ransomware group's exploitation of search ads to distribute Cobalt Strike via counterfeit WinSCP websites highlights the evolving tactics employed by cybercriminals. By capitalizing on the popularity of trusted applications and leveraging advanced tools, these threat actors can infiltrate corporate networks and cause significant harm. Staying informed, implementing effective security measures, and promoting a culture of cybersecurity awareness are crucial in safeguarding against such attacks.

In the face of evolving cyber threats like the BlackCat ransomware group, it's vital to ensure the security of your systems. Armoryze offers a comprehensive Managed Detection and Ransomware Service that can help safeguard your organization against such attacks.

Our expert team employs advanced threat intelligence, proactive monitoring, and rapid incident response to detect and mitigate ransomware threats. With Armoryze, you can have peace of mind knowing that your systems are protected by cutting-edge technology and experienced professionals.

Don't wait until it's too late. Take action today and fortify your defenses against ransomware attacks. Contact us to learn more about our Managed Detection and Ransomware Service and to schedule a FREE consultation. Together, we can ensure the security and resilience of your organization's digital infrastructure.