BlackCat Threat Actors Shift to Rust Payloads

An emerging threat group, currently tracked as ALPHV or BlackCat, has developed malicious payloads through the Rust programming language and is the first to deploy them in the wild. Since early December the key individual of ALPHV, who has ties back to REvil operations, has been advertising a ransomware-as-a-service (RaaS) campaign on two popular cybercrime forums, inviting other associates of the forums to join together and unleash massive ransomware attacks against large companies. While the threat group seems to be in the early stages of development there are already a handful of victims currently being ransomed and under threat of their data being exposed. Tactics of the threat group are closely related with most ransomware affiliates, where threat actors will infiltrate the victims network(s), deploy malicious payloads for data exfiltration, then deploy a ransomware strain throughout all local systems. Post-exploitation, the victim has the choice of paying the hefty ransom imposed by BlackCat or risk having potential sensitive data exposed. While the malicious Rust payloads are new to the cybersecurity realm, some threat actors have been following suit and switching from C/C++ programming languages to Rust to craft their payloads; even though BlackCat is the first to officially do so. CTAPT will continue to monitor the developments of this threat group and provide additional updates accordingly.