Hello world, a coding mistake in a ransomware payload led to a loss of tens of millions
of dollars for the cybercrime group blackmatter. Cyber Security company Emsisoft discovered
the vulnerability and has been using it for months to covertly recover victims’ files.
Though Emsisoft’s mission was thrown into disarray when a dark web link was leaked and
trolls started interfering - I think you guys are going to really like this story.
But first, who is blackmatter? Blackmatter is thought to be a rebrand of the now deceased
ransomware group darkside, which was responsible for the colonial pipeline hack - that was
one of the best examples of how a cyberattack can potentially paralyze a country. In that
hack, the colonial pipeline was ransomed, knocking one of America’s main fuel pipelines
offline, causing fuel shortages in parts of the country.
Now, you can’t cause so much trouble without attracting the ire of the FBI. And as I was
writing the script for this video the FBI announced a 10 million dollar reward “for
information leading to the location, arrest, and/or conviction of owners/operators or affiliates
of the darkside ransomware as a service group”. This is pretty significant, the largest reward
ever offered by the US was 25 million dollars on the head of Osama Bin Laden, the reward
for darkside is 40% that of Bin Laden, which is a lot.
Darkside disappeared earlier this year, until rebooting operations when a user going by
the name blackmatter appeared on cybercrime forums, offering cash in exchange for access
to networks of corporations doing in excess of 100 million dollars of revenue. A dark
web site for this newly spawned group popped up shortly after, which interestingly delineated
a blacklist of industries they wouldn’t attack. Including pipelines - the very thing
that had gotten their previous form “darkside” into hot water. This list of targets closely
maps on to what the US considers “critical infrastructure” - which are the sectors
law enforcement gets most antsy about when attacked - for understandable reasons. These
are also the sectors which the US declared as off-limits to Putin when it comes to hacking.
All suggesting that blackmatter made the conscious decision to fence off these industries because
they just want to make money quietly, attracting as little attention from law enforcement and
the media as possible.
But, blackmatter didn’t keep to their word for too long, and were recently observed attacking
the agricultural sector, an industry on the list as critical infrastructure.
Enter Emsisoft, they discovered what they describe as a “critical flaw in the BlackMatter”
ransomware in December of last year, and launched a mission, helping “victims recover their
files without paying a ransom”. This mission of theirs has been kept top secret until now,
their reasoning being “In the case of gangs that we believe to be technically sophisticated
– such as DarkSide/BlackMatter – we do not publicly announce or disclose the existence
of vulnerabilities. Instead, we communicate our decryption capabilities in private via
a network of law enforcement agencies and trusted parties” … “this approach enables
us to help as many victims for as long as possible.”.
Frustratingly Emsisoft doesn’t spill any beans on what the particular vulnerability
was. And whilst the initial vulnerability was fixed in January this year it wasn’t
long until blackmatter made yet another mistake in their ransomware payload, allowing Emsisoft
once again to restart their mission recovering victims’ files. However, it wasn’t all
plain sailing. And you’re going to love this next bit. They detail that “During
one of the more high profile BlackMatter incidents in September 2021, the ransom note was leaked.”
Now, a typical ransom note includes a dark web link to where the victim can negotiate
with the gang, because this link was leaked anyone could join the dark web chat and talk
to blackmatter themselves. And so, the trolling of blackmatter commenced. In one instance,
someone joined the chat and demanded 152 bitcoin from the gang...
“We both need to agree that each party should gain from the negotiation. You send us bitcoin,
we send you bitcoin, ransom is paid from both sides and everyone moves on! We are waiting
for your update! Don’t forget there are two ways to resolve conflicts, through violence
or negotiation. Violence is for wild beasts, negotiation is for human beings. You choose”.
Blackmatter had no idea the chat had been hijacked, so responded by calling coveware
(the ransom recovery experts hired by the victims), clowns.
In another example, a troll simply told blackmatter “we don’t care, you will not receive payment,
delete the key and go away”. To which blackmatter responded with a short novel on how they were
going to publish the victim’s data, and that the victim had “violated blackmatter’s
data recovery guidelines by deciding to use the services of coveware”
The troll simply responded “The only thing we violated was your mother”.
You won’t be surprised to hear that twitter absolutely loved this back and forth. Emsisoft
however, wasn’t too pleased. “screenshots of the conversations were taken and circulated
within the Twitter community, which caused even more people to join the “fun”, quickly
derailing any sort of intelligence gathering by law enforcement and security researchers
in the process.”
In response to the trolling campaign, blackmatter have now implemented a company verification
check for anyone who joins the negotiation chat. Emsisoft said this “[locked them and]
everyone else out in the process. Unfortunately, that meant one of the most valuable tools
we had to reach victims disappeared literally overnight, leading to missed victims who may
have unnecessarily paid ransoms. ”
As for those code mistakes “BlackMatter released an update several weeks ago that
fixed the flaw [that Emisoft was] using to help victims.”
This video is sponsored by Linode, who are giving you $100 worth of free cloud computing.
Linode is a totally customisable cloud hosting platform - whether you’re looking to quickly
spin up a VPN, website or host a kubernetes cluster - Linode has you covered. If it runs
on linux it’ll run on linode.
Linode just announced availability of their NVME block storage, the first alternative
cloud provider to officially support this state of the art hardware. Linode’s philosophy
is to focus on providing all the tools a developer really needs at competitive prices. Use the
link in the description now to claim your free $100.
If you enjoy this kind of video make sure to help me out by caressing the like button
for the youtube AI as well as turning on those sub notifications.
If you want to see what goes on behind the scenes make sure to follow me on the instagrams,
I’m @jhonti I will of course link it in the description.
And if you’re looking for something to watch next go check out my previous video on how
bad actors have been exploiting craigslist to infect victims
As always sources will be linked in the video description, stay tuned for more hacking videos,
and have a good one.