<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof ContentPasted0">
Hello,
<div><br class="ContentPasted0">
</div>
<div class="ContentPasted0">I hope everyone is doing well!</div>
<div><br class="ContentPasted0">
</div>
<div class="ContentPasted0">Below is the entry for today.</div>
<div><br class="ContentPasted0">
</div>
<div class="ContentPasted0">10/06/2022 - Diary entry #?609:</div>
<div><br class="ContentPasted0">
</div>
<blockquote style="margin-top:0;margin-bottom:0">
<div class="ContentPasted0 ContentPasted1">Covered in multiple of our Daily Diaries, most recently in our Daily Diary #576, BlackByte is one of the many ransomware operations active nowadays. Operating under the ransomware-as-a-service model, BlackByte is notorious
for targeting manufacturing, healthcare, and other industries in the U.S. and Europe.
<div><br class="ContentPasted1">
</div>
<div class="ContentPasted1">In our Daily Diary #576, we covered a new version of BlackByte’s wall-of-shame blog, revealing an upgrade in BlackByte's extortion model known as “pay-to-delay“ – also observed earlier on LockBit 3.0 blog. After a victim's data is
published in their wall-of-shame, they will have three options: extend the countdown timer for 24 hours (costing $5,000 USD), destroy all the stored information (costing $300,000 USD), or download the data (costing $200,000 USD).</div>
<div><br class="ContentPasted1">
</div>
<div class="ContentPasted1">Most recently, BlackByte Ransomware was observed using a technique to bypass security products by abusing a known vulnerability in the legitimate vulnerable driver “RTCore64.sys”, affected by an authenticated read/write arbitrary
memory vulnerability (tracked as CVE-2019-16098).</div>
<div><br class="ContentPasted1">
</div>
<div class="ContentPasted1">To explore the vulnerability during their attacks, they deploy on the victim’s machine and execute the vulnerable driver. Then, BlackByte ransomware abuses the driver to remove callback entries of drivers used by EDR products from
kernel memory.</div>
<div><br class="ContentPasted1">
</div>
A similar technique was covered before in our Daily Diaries #502 and #588 when AvosLocker abused Avast’s anti-rootkit driver and a ransomware operator abused a video game anti-cheat driver to deploy ransomware. Abusing vulnerable drivers allow malware to execute
dangerous operations in an elevated context, for that reason we believe this is becoming a trend among ransomware attacks. We recommend system administrators monitor devices installing outdated (vulnerable) drivers, by marking the machines as suspect and isolating
them from the network.<br>
</div>
</blockquote>
<div><br class="ContentPasted0">
</div>
Kind Regards,<br>
</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<table style="font-size:medium; font-family:"Times New Roman"">
<tbody>
<tr>
<td style="width:180px" align="left">
<table width="120" align="left">
<tbody>
<tr>
<td colspan="3" align="center"><a href="https://www.appgate.com/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="120" height="30" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/logo@2x.png"></a></td>
</tr>
<tr>
<td colspan="3" align="center"> </td>
</tr>
<tr>
<td width="37%" align="center"><a href="https://www.linkedin.com/company/appgate-security/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="18" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/likedin@2x.png"></a></td>
<td width="28%"><a href="https://twitter.com/AppgateSecurity" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="20" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/twitter@2x.png"></a></td>
<td width="35%"><a href="https://www.youtube.com/channel/UC-8GvxcZbm-R3EJNl8jYjiQ" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="width: 26px; height: 18px; max-width: initial;" width="26" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/youtube@2x.png"></a></td>
</tr>
</tbody>
</table>
<p style="margin-top:0px; margin-bottom:0px"> </p>
</td>
<td colspan="2" rowspan="2" style="width:350px">
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
<strong>MART</strong><br>
</p>
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
Malware Analysis and Research Team<br>
<strong>Appgate</strong></p>
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
E:<span style="margin:0px"> <a title="mailto:ctas-mat@appgate.com" href="mailto:ctas-mat@appgate.com">
ctas-mat@appgate.com</a></span><br>
</p>
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
<br>
<span style="margin:0px; background-color:white"></span></p>
</td>
</tr>
</tbody>
</table>
<br>
</div>
</div>
</div>
</div>
</body>
</html>