Explained: BlackByte ransomware operation and how it is affecting Windows users


The US security agency FBI has issued a warning against a relatively new ransomware operation named BlackByte. The operation is targeting PCs that run on Microsoft Windows. FBI issued the new warning after the BlackByte ransomware gang attacked critical infrastructure and other high-profile targets in the country.
Cybersecurity researchers at Sophos have reported that this ransomware group is using a new technique for the attacks. This new technique allows attackers to hide ransomware from security products (like anti-virus). The BlackByte ransomware can exploit a security flaw that is present in more than 1,000 drivers and is common in several antivirus software.
How BlackByte is attacking Windows users
Windows systems have a graphics utility driver named RTCorec64.sys where a vulnerability (CVE-2019-16098) is reportedly being misused by the BlackByte ransomware gang. The real function of this driver is to provide extended control over the graphics card by overclocking it.

This vulnerability allows attackers to read and write the memory of the system by taking over an authenticated user account, which can eventually be exploited to access information, code execution, etc.
The researchers have named this technique — “Bring Your Own Drive” which allows attackers to remain undetected by drivers used in more than 1,000 antivirus software. BlackByte exploits the drivers’ vulnerability to control the targeted system and commands it to switch off the ETW or Event Tracing for Windows and other common routines that are used in security products.
What is Event Tracing for Windows or ETW
Senior manager for threat research at Sophos, Christopher Budd has explained that ETW is like “the guard at the front gate” in computers. The entire system becomes vulnerable when the primary guard is down. Moreover, as several antivirus software providers use ETW, BlackByte can bypass multiple security products.

At first, the attackers abuse this vulnerability to quietly takes control of the systems and then trigger a ransomware attack by demanding ransom payment from the victims in exchange for the decryption key.
How users can protect themselves from BlackByte
Researchers at Sophos have recommended users to update their drivers regularly which is expected to patch this security flaw. Users have also been advised to blocklist the drivers that are still vulnerable.
Tech organisations should also regularly issue updates and security patches as well as provide multi-factor authentication (MFA) for users to stay safe from these ransomware attacks.



Read original article here

Denial of responsibility! TechCodex is an automatic aggregator of the all world’s media. In each content, the hyperlink to the primary source is specified. All trademarks belong to their rightful owners, all materials to their authors. If you are the owner of the content and do not want us to publish your materials, please contact us by email – [email protected]. The content will be deleted within 24 hours.

Leave a comment

This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish. Accept Read More