Flash Report: German Energy Firms Hit by BlackCat Ransomware

Flash Report: German Energy Firms Hit by BlackCat Ransomware

A series of cyber attacks targeting energy companies in Europe has authorities on high alert, given rising fuel prices and the threat of supply disruption should the political crisis in Ukraine escalate into conflict. On February 3, 2022, German authorities implicated the BlackCat ransomware group as a suspect in a recent ransomware attack against two German oil companies that has already caused a major impact on crude supply. The attack echoes the widespread disruption caused by the Colonial Pipeline ransomware attack in 2021.

Other companies across Europe have also experienced cyber attacks in recent days, including international terminals operated by SEA-invest in Belgium and tank terminals operated by Dutch company Evos. However, it has not been confirmed if these are related to the German attacks. The attacks are mainly affecting the loading and unloading of cargo at the impacted facilities; if normal operations do not resolve soon, these impacts are expected to spread into the shipping and logistics sector. The targeting of oil distribution facilities at a time when a lack of oil supply is leading to high prices is noteworthy, as it could be designed to worsen the price problem. These attacks also come at a time of heightened tensions between Europe and Russia over Ukraine. If the hacks are linked to Russian threat actors, such targeting may be designed to emphasize potential consequences for European leaders who have been weakened politically by high energy prices.

ZeroFox predicts supply chain compromises will continue on an upward trajectory in terms of frequency, scale, and sophistication in 2022. The use of third-party compromises as a means to distribute ransomware is likely to increase, driven in part by increasingly lucrative Ransomware-as-a-Service offerings lowering the barriers to entry for threat actors while putting effective malware in the hands of more operators. With supply chain issues affecting multiple aspects of the global trade, ransomware-related attacks are likely to generate significant media coverage—possibly acting as a mitigating factor, as threat actors look to avoid attention from authorities.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Maintain regular offsite backups to protect against data encryption, corruption, and natural disasters.
• Files stolen in ransomware attacks can often be sizable. Establish a detection rule for files leaving the network of an above-average size—particularly those in a compressed format, such as .zip, .rar, .tar, .7z, or .gz.
• Avoid opening unsolicited attachments and never click suspicious links.
• Enforce best practices on passwords, such as complexity, forced expiration, and prohibiting password reuse.
• Do not share passwords, and do not reuse the same password on different websites and applications.
• Log and monitor all administrative actions as much as possible. Alert on any suspicious activity.
• Consider disabling, or at least logging, all network activity outside of normal business hours for most users where possible.
• If a workstation is infected with malware, quarantine it on a private network segment with no external connections.

Details

On January 29, 2022, Oiltanking GmbH Group and Mabanaft GmbH & Co. KG Group—which operate under the same Hamburg-based parent, Marquard & Bahls—reported a ransomware attack launched by the BlackCat ransomware group (also known as ALPHV) that disrupted IT systems and impacted the companies’ supply chains. As over 200 gas stations were affected by the attack, the companies were forced to declare a force majeure for the majority of inland supply activities in Germany, resulting in the energy company Shell re-routing its oil supplies to other depots. Parallels in disruption can be drawn between the attacks on these German companies and a devastating ransomware attack on Colonial Pipeline that crippled its business services and left significant parts of the East Coast without access to gas for over five days.

BlackCat operators use various techniques commonplace in the ransomware space, including encrypting and leaking target data; naming and shaming its victims on its leak site; selling the leaked data to the highest bidder, and offering DDoS attack capabilities in its toolkit. What is notable is that BlackCat payloads are written in Rust, a more secure programming language. This is consistent with an observed trend of cyber criminals adopting various programming languages likely to hamper reverse engineering efforts by security researchers.

The group’s data leak site publicly lists new victims across a wide range of industries, including communications, technology, manufacturing, retail, and financial services. ZeroFox has been tracking BlackCat’s activities since December 8, 2021, when newly-registered forum actor "ransom" advertised an ALPHV-ng ransomware affiliate program on the multi-language cyber criminal forum RAMP actively seeking partners and offering lucrative payouts. Since December 2021, ZeroFox has observed 30 instances of BlackCat attacks across multiple regions; over 46 percent of its victims have been located in the United States. The total number of victims, including those that have paid a ransom to avoid exposure, is likely greater.

Figure 1. BlackCat’s activity per country.
Source: ZeroFox Research

ZeroFox has previously collected sample ransom notes affiliated with BlackCat dating to December 2021 and January 2022.

Figure 2. A BlackCat alert in the ZeroFox Platform.
Source: ZeroFox Research

Figure 3. A BlackCat ransom note template as extracted by the Triage sandbox service.
Source: Triage

IOCs

SHA256

• 40f57275721bd74cc59c0c59c9f98c8e0d1742b7ae86a46e83e985cc4039c3a5
• 1724730c8d2f3e034e1b87154d7a8af0f7801380bd2da3429fd3f27b9bdd7ddc
• 59868f4b346bd401e067380cac69080709c86e06fae219bfb5bc17605a71ab3f
• 40f57275721bd74cc59c0c59c9f98c8e0d1742b7ae86a46e83e985cc4039c3a5
• d767524e1bbb8d50129485ffa667eb1d379c745c30d4588672636998c20f857f
• 2587001d6599f0ec03534ea823aab0febb75e83f657fadc3a662338cc08646b0
• f837f1cd60e9941aa60f7be50a8f2aaaac380f560db8ee001408f35c1b7a97cb
• f7a038f9b91c40e9d67f4168997d7d8c12c2d27cd9e36c413dd021796a24e083
• e7060538ee4b48b0b975c8928c617f218703dab7aa7814ce97481596f2a78556