mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
27 lines
1.2 KiB
YAML
27 lines
1.2 KiB
YAML
name: BlackMatter Ransomware
|
|
id: 0da348a3-78a0-412e-ab27-2de9dd7f9fee
|
|
version: 1
|
|
date: '2021-09-06'
|
|
author: Teoderick Contreras, Splunk
|
|
description: Leverage searches that allow you to detect and investigate unusual activities
|
|
that might relate to the BlackMatter ransomware, including looking for file writes
|
|
associated with BlackMatter, force safe mode boot, autadminlogon account registry
|
|
modification and more.
|
|
narrative: BlackMatter ransomware campaigns targeting healthcare and other vertical
|
|
sectors, involve the use of ransomware payloads along with exfiltration of data
|
|
per HHS bulletin. Malicious actors demand payment for ransome of data and threaten
|
|
deletion and exposure of exfiltrated data.
|
|
references:
|
|
- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
|
|
- https://www.bleepingcomputer.com/news/security/blackmatter-ransomware-gang-rises-from-the-ashes-of-darkside-revil/
|
|
- https://blog.malwarebytes.com/ransomware/2021/07/blackmatter-a-new-ransomware-group-claims-link-to-darkside-revil/
|
|
tags:
|
|
analytic_story: BlackMatter Ransomware
|
|
category:
|
|
- Malware
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
usecase: Advanced Threat Detection
|