{"id":25639,"date":"2022-10-26T00:46:30","date_gmt":"2022-10-26T00:46:30","guid":{"rendered":"https:\/\/www.esecurityplanet.com\/?p=25639"},"modified":"2022-10-26T20:16:21","modified_gmt":"2022-10-26T20:16:21","slug":"data-exfiltration-blackbyte-exbyte-hive-group","status":"publish","type":"post","link":"https:\/\/www.esecurityplanet.com\/threats\/data-exfiltration-blackbyte-exbyte-hive-group\/","title":{"rendered":"Data Exfiltration: Symantec Warns of Exbyte Threat as Hive Group Leaks Tata Data"},"content":{"rendered":"\n

Symantec researchers are warning<\/a> that a BlackByte ransomware<\/a> affiliate has begun using a custom data exfiltration tool, Infostealer.Exbyte, to steal data from victims’ networks as part of their attacks.<\/p>\n\n\n\n

Still, as a recent breach of an Indian power company by a different ransomware group demonstrates, the extra effort of stealing data doesn’t always pay off for the attackers \u2014 even when it leads to embarrassing data leaks for the victim.<\/p>\n\n\n\n

What may be most interesting in the ongoing development of exfiltration tools is that some ransomware groups may be about to change tactics entirely \u2014 more on that in a moment.<\/p>\n\n\n\n

BlackByte Exfiltration Tool<\/h2>\n\n\n\n

The new BlackByte exfiltration tool performs a series of checks both to make sure it’s not running in a sandboxed<\/a> environment and to monitor for antivirus tools<\/a> \u2013 similar to BlackByte’s pattern of behavior. Exbyte then searches for document files (.txt, .doc, .pdf), and uploads them to an account on the MEGA cloud storage service.<\/p>\n\n\n\n

The Symantec researchers noted that Exbyte follows in the footsteps of several other custom-developed data exfiltration tools, including Exmatter, Ryuk Stealer, and StealBit. “The fact that actors are now creating custom tools for use in BlackByte attacks suggests that it may be on the way to becoming one of the dominant ransomware threats,” they wrote.<\/p>\n\n\n\n

See also: How to Recover From a Ransomware Attack<\/a><\/p>\n\n\n\n

Exfiltration to Replace Ransomware Encryption?<\/h2>\n\n\n\n

Cyderes researchers said<\/a> the evolution of exfiltration suggests that threat actors may eventually use data theft in place of encryption.<\/p>\n\n\n\n

“With data exfiltration now the norm among threat actors, developing stable, secure, and fast ransomware to encrypt files is a redundant and costly endeavor compared to corrupting files and using the exfiltrated copies as the means of data recovery,” they wrote.<\/p>\n\n\n\n

Ransomware affiliates have “lost out on profits from successful intrusions due to exploitable flaws in the ransomware deployed, as was the case with BlackMatter,” they added. “Eliminating the step of encrypting the data makes the process faster and eliminates the risk of not getting the full payout, or that the victim will find other ways to decrypt the data.”<\/p>\n\n\n\n

“Data destruction is rumored to be where ransomware is going to go, but we haven\u2019t actually seen it in the wild,” they noted. “During a recent incident response, however, Cyderes and Stairwell discovered signs  that threat actors are actively in the process of staging and developing this capability.”<\/p>\n\n\n\n

That incident \u2013 involving a BlackCat\/ALPHV\u00a0ransomware investigation \u2013 turned up an exfiltration tool with hardcoded sftp credentials that was analyzed by Stairwell\u2019s Threat Research Team, which found partially-implemented data destruction functionality.<\/p>\n\n\n\n

“The use of data destruction by affiliate-level actors in lieu of RaaS<\/a> deployment would mark a large shift in the data extortion landscape and would signal the balkanization of financially-motivated intrusion actors currently working under the banners of RaaS affiliate programs,” the Stairwell researchers wrote<\/a>.<\/p>\n\n\n\n

Exfiltration also adds a key tool to attackers’ arsenals \u2013 Rapid7 recently warned<\/a> of the ongoing evolution of double extortion, in which ransomware is used both to hold the victim’s data for ransom and to demand additional money to prevent the public release of sensitive information.<\/p>\n\n\n\n

The technique was pioneered, Rapid7 noted, by the Maze ransomware group. “Throughout most of 2020 Maze was the leader of the double extortion tactic among ransomware groups, accounting for 30% of the 94 reported cases of double extortion between April and December of 2020,” the researchers wrote.<\/p>\n\n\n\n

As decryption fails most of the time, victims don’t have much incentive to pay for decryption keys, so preventing leaks becomes a more compelling incentive for companies to pay \u2014 and could lead to a completely new ransomware tactic.<\/p>\n\n\n\n

Also read: How to Decrypt Ransomware Files \u2013 And What to Do When That Fails<\/a><\/p>\n\n\n\n

When Extortion Fails and Data Leaks<\/h2>\n\n\n\n

The recent attack on India’s Tata Power by the Hive ransomware group is a vivid example of the extortion threat, though it appears that in this case, the attackers were unsuccessful in their extortion attempts.<\/p>\n\n\n\n

In an October 14 stock filing<\/a> [PDF], the company described the breach as “a cyber-attack on its IT infrastructure impacting some of its IT systems,” but didn’t mention ransomware or data exfiltration.<\/p>\n\n\n\n

As the hackers began leaking the data earlier this week, security researcher Dominic Alvieri noted<\/a> that the group claimed to have information on all of Tata Power’s bank accounts and recent balance details, and researcher Rakesh Krishnan separately posted<\/a> four screenshots of leaked bank details, adding that employees’ personal information, engineering drawings, and client contracts were also leaked.<\/p>\n\n\n\n

Read next: Best Backup Solutions for Ransomware Protection<\/a><\/p>\n\n\n

\n \n\n \n\n
\n \n <\/path>\n <\/svg>\n <\/div>\n \n
\n
\n

\n Get the Free Cybersecurity Newsletter <\/h3>\n \n \n

\n Strengthen your organization's IT security defenses by keeping up to date on the latest cybersecurity news, solutions, and best practices. Delivered every Monday, Tuesday and Thursday <\/p>\n <\/div>\n\n

\n
\n \n Email Address\n <\/label>\n \n <\/div>\n\n
\n
\n \n \n By signing up to receive our newsletter, you agree to our Terms of Use and Privacy Policy. You can unsubscribe at any time. <\/label>\n <\/div>\n <\/div>\n \n