The CISA, FBI, and NSA have published a cyber security advisory warning organisations of BlackMatter ransomware attacks which have targeted multiple US critical infrastructure entities in the food and agriculture sector.
The organisations underlined that BlackMatter, first seen in July 2021, is a ransomware as a service (RaaS) tool which cyber actors have used to access a network and remotely encrypt host and shared drives. The developers who sell the tool are able to profit from cyber criminal affiliates who deploy it, said the advisory.
The agencies underlined that ransomware attacks against critical infrastructure entities could directly affect consumer access to these services, which is why the CISA, FBI, and NSA have urged all organisations to implement a number of mitigations to help organisations reduce the risk of compromise from BlackMatter ransomware attacks.
The mitigations include implementing and enforcing backup procedures, using strong unique passwords, using multi-factor authentication, and implementing network segmentation and traversal monitoring.
“This advisory highlights the evolving and persistent nature of criminal cyber actors and the need for a collective public and private approach to reduce the impact and prevalence of ransomware attacks,” said Eric Goldstein, executive assistant director for Cybersecurity at the CISA.
RELATED RESOURCE
The best defence against ransomware
How ransomware is evolving and how to defend against it
“CISA, FBI and NSA are taking every step possible to try to make it harder for cyber criminals to operate. Americans can help us in this long-term endeavor by visiting Stopransomware.gov to learn how to reduce their risk of becoming a victim of ransomware.”
Bryan Vorndran, assistant director of the FBI’s Cyber Division, highlighted the need for organisations to report any ransomware incidents by contacting their local FBI Field Office and speaking to a cyber agent.
“By reporting a cyber incident, targeted entities are enhancing our ability to respond and investigate with the goal of disrupting cybercriminal operations,” he said.
In September, the BlackMatter ransomware group hit New Cooperative, an Iowa-based farming cooperative, with a $5.9 million ransom demand. The gang had obtained financial documents, networking information, employee social security numbers, and the source code for a farmer technology platform from the cooperative. The timing of the attack made it crucial for the organisation to get its systems back online as soon as possible as the harvesting season was about to begin.
-
Prolific ransomware operator added to Europe’s Most Wanted list as US dangles $10 million rewardNews The US Department of Justice is offering a reward of up to $10 million for information leading to the arrest of Volodymyr Viktorovych Tymoshchuk, an alleged ransomware criminal.
-
Jaguar Land Rover “did the right thing” shutting down systems to thwart cyber attackNews The attack on Jaguar Land Rover highlights the growing attractiveness of the automotive sector
-
Ransomware attack on IT supplier disrupts hundreds of Swedish municipalitiesNews The attack on IT systems supplier Miljödata has impacted public sector services across the country
-
A notorious hacker group is ramping up cloud-based ransomware attacksNews The Storm-0501 threat group is refining its tactics, according to Microsoft, shifting away from traditional endpoint-based attacks and toward cloud-based ransomware.
-
Security researchers have just identified what could be the first ‘AI-powered’ ransomware strain – and it uses OpenAI’s gpt-oss-20b modelNews Using OpenAI's gpt-oss:20b model, ‘PromptLock’ generates malicious Lua scripts via the Ollama API.
-
Data I/O shuts down systems in wake of ransomware attack
News Regulatory filings by Data I/O suggest the costs of dealing with the attack could be significant
-
Average ransom payment doubles in a single quarterNews Targeted social engineering and data exfiltration have become the biggest tactics as three major ransomware groups dominate
-
BlackSuit ransomware gang taken down in latest law enforcement sting – but members have already formed a new groupNews The notorious gang has seen its servers taken down and bitcoin seized, but may have morphed into a new group called Chaos
