The gang behind the ransomware ALPHV BlackCat created a clone of the victim's site in order to upload the stolen data.
The operators of the ALPHV BlackCat ransomware have gotten creative with their extortion tactics and, in at least one case, created a copy of their victim's website to post the stolen data on it.
It appears that ALPHV, also known as BlackCat ransomware, is known to be trying out new extortion tactics to pressure and shame victims into paying up.
Even though these tactics may not always be successful, they introduce an ever‑growing threat landscape that victims have to navigate.
On December 26, the threat actor posted on a data leak website hidden on the Tor network that they had breached a financial services company.
As the victim did not comply with the hackers' demands, the ALPHV BlackCat ransomware published all stolen files as punishment – a typical step for ransomware operators.
What was different from the usual procedure of the ALPHV BlackCat ransomwarewas that the hackers also decided to leak the data to a website that mimics the victim's page in appearance and domain name.
See also: Citrix: Thousands of servers at risk due to security vulnerabilities
The hackers did not keep the original headers of the website. They used their own headers to organize the leaked data.
The cloned website is located on the broader web to ensure the availability of the stolen files. Currently it displays various documents, from memos to personnel data, payment forms, employee information, data on assets and expenses, financial data for partners and passport documents.
In total, there are 3.5 GB of documents. ALPHV BlackCat also uploaded the stolen data to a file sharing service that allows anonymous uploads and distributed the link to the leak website.
Brett Callow, a threat analyst at cybersecurity firm Emsisoft, said that sharing the data on a typosquatted domain would be a bigger concern for the victim company than distributing the data through a Tor website, which is mostly known in the infosec.
"I wouldn't be surprised at all if the ALPHV BlackCat ransomware had tried to weaponize the company's customers by pointing them to this website," Brett Callow.
Ransomware gangs are always looking for new options to blackmail their victims. Between publishing the name of the compromised company, stealing data, threatening to publish it unless the ransom , and threatening DDoS, this tactic could represent the beginning of a new trend that other ransomware gangs may adopt, especially since the cost to do so is not at all high.
It is not clear at present how successful this strategy is, but it exposes the breach to a larger audience, putting the victim in a more vulnerable position, as its data is immediately available without any restriction.
See also: Royal ransomware: Claimed responsibility for attack on Intrado
ALPHV BlackCat is the first ransomware to create a search for specific data stolen from their victims. The pages are intended for the victims' customers and employees to check if their data has been stolen by the hackers.
ALPHV /BlackCat has launched attacks on more than 60 organizations, targeting both non-profits and companies in industries ranging from technology to real estate. In one major attack, it breached the Austrian federal state of Carinthia, demanding a $5 million ransom. The group also holds the distinction of being the first to attack an organization using RUST, which is generally considered one of the most secure programming languages.
Source: bleepingcomputer.com
