The threat actors responsible for the devastating 2021 Colonial Pipeline ransomware attack have been evolving their capabilities with the introduction of new tactics, techniques, and procedures (TTPs) used alongside Noberus (aka BlackCat, ALPHV) ransomware, a successor to the Darkside and BlackMatter ransomware strains. In a report published by Symantec’s Threat Hunter Team, researchers break down the TTPs of the group which they have named Coreid (aka FIN7, Carbon Spider). First seen in November 2021, Noberus is thought to be a successor payload to the Darkside and BlackMatter ransomware strains, this time based on the Rust programming language. Coreid has capitalized on the cross-platform nature of Rust and claims that “Noberus is capable of encrypting files on Windows, EXSI, Debian, ReadyNAS, and Synology operating systems.” Noberus offers threat actors two (2) different encryption algorithms (ChaCha20 and AES) and four (4) different ways to encrypt data (Full, Fast, DotPattern, and SmartPattern). This type of functionality is described as “intermittent encryption,” and depends on the target infrastructure and needs of the threat actor. Coreid emphasizes that Noberus is superior to the strains used in other Ransomware-as-a-Service (RaaS) operations due to privileged access through its own dark web onion domain, giving affiliates access to fully encrypted negotiation chats which could only be accessed by the intended victim. In the summer of 2022, Coreid made significant updates to Noberus including the introduction of a build that gives Coreid affiliates more options for encrypting non-standard architectures. Additionally, Coreid introduced an encryption functionality for the Windows build of Noberus called “SAFEMODE”, which can reboot the system into safe mode and safe mode with networking. Alongside the evolution of the ransomware strain itself, Noberus has recently been observed in-conjunction with updated data exfiltration, and info/credential-stealing tools, known as “Exmatter,” and “Eamfo,” respectively. The Exmatter exfiltration tool (“Trojan.Exmatter”) was designed to scan and steal specific file types from a number of selected directories, funneling them to an attacker-controlled command-and-control (C2) server. Researchers have also observed the credential-stealer Eamfo being leveraged alongside Noberus by at least one (1) affiliate. Eamfo is specifically designed to steal credentials stored in Veeam backups, a software developed to backup, restore, and replicate data on virtual machines (VMs). Once connected, Eamfo will steal the encrypted credential sets and decrypt them, allowing the threat actors to escalate their privileges and move laterally across the network. The updates to Coreid’s suite of services and tools, as well as their robust affiliate program, threatens both government and private enterprises. CTIX analysts will continue to monitor the evolution of Noberus ransomware and may publish updates in the future.