The CISA, FBI, and NSA have published a cyber security advisory warning organisations of BlackMatter ransomware attacks which have targeted multiple US critical infrastructure entities in the food and agriculture sector.
The organisations underlined that BlackMatter, first seen in July 2021, is a ransomware as a service (RaaS) tool which cyber actors have used to access a network and remotely encrypt host and shared drives. The developers who sell the tool are able to profit from cyber criminal affiliates who deploy it, said the advisory.
The agencies underlined that ransomware attacks against critical infrastructure entities could directly affect consumer access to these services, which is why the CISA, FBI, and NSA have urged all organisations to implement a number of mitigations to help organisations reduce the risk of compromise from BlackMatter ransomware attacks.
The mitigations include implementing and enforcing backup procedures, using strong unique passwords, using multi-factor authentication, and implementing network segmentation and traversal monitoring.
“This advisory highlights the evolving and persistent nature of criminal cyber actors and the need for a collective public and private approach to reduce the impact and prevalence of ransomware attacks,” said Eric Goldstein, executive assistant director for Cybersecurity at the CISA.
RELATED RESOURCE
The best defence against ransomware
How ransomware is evolving and how to defend against it
“CISA, FBI and NSA are taking every step possible to try to make it harder for cyber criminals to operate. Americans can help us in this long-term endeavor by visiting Stopransomware.gov to learn how to reduce their risk of becoming a victim of ransomware.”
Bryan Vorndran, assistant director of the FBI’s Cyber Division, highlighted the need for organisations to report any ransomware incidents by contacting their local FBI Field Office and speaking to a cyber agent.
“By reporting a cyber incident, targeted entities are enhancing our ability to respond and investigate with the goal of disrupting cybercriminal operations,” he said.
In September, the BlackMatter ransomware group hit New Cooperative, an Iowa-based farming cooperative, with a $5.9 million ransom demand. The gang had obtained financial documents, networking information, employee social security numbers, and the source code for a farmer technology platform from the cooperative. The timing of the attack made it crucial for the organisation to get its systems back online as soon as possible as the harvesting season was about to begin.
-
A major ransomware hosting provider just got hit US with sanctionsNews Aeza Group's services were being used for ransomware, infostealers, and disinformation
-
Hackers are using PDFs to impersonate big brands like Microsoft and PayPal in a new threat campaignNews Hackers are increasingly using PDF attachments to impersonate major brands in phishing campaigns, according to new research from Cisco Talos.
-
Swiss government data published following supply chain attack – here’s what we know about the culpritsNews Radix, a non-profit organization in the health promotion sector, supplies a number of federal offices, whose data has apparently been accessed.
-
Ransomware victims are getting better at haggling with hackersNews While nearly half of companies paid a ransom to get their data back last year, victims are taking an increasingly hard line with hackers to strike fair deals.
-
LockBit data dump reveals a treasure trove of intel on the notorious hacker group
News An analysis of May's SQL database dump shows how much LockBit was really making
-
‘I take pleasure in thinking I can rid society of at least some of them’: A cyber vigilante is dumping information on notorious ransomware criminals – and security experts say police will be keeping close tabsNews An anonymous whistleblower has released large amounts of data allegedly linked to the ransomware gangs
-
It's been a bad week for ransomware operatorsNews A host of ransomware strains have been neutralized, servers seized, and key players indicted
-
Everything we know about the Peter Green Chilled cyber attackNews A ransomware attack on the chilled food distributor highlights the supply chain risks within the retail sector
-
Scattered Spider: Who are the alleged hackers behind the M&S cyber attack?News The Scattered Spider group has been highly active in recent years
-
Ransomware attacks are rising — but quiet payouts could mean there's more than actually reported
News Ransomware attacks continue to climb, but they may be even higher than official figures show as companies choose to quietly pay to make such incidents go away.
