Ankura CTIX FLASH Update - September 4, 2024

Ransomware/Malware Activity

Cicada3301 Ransomware: An Evolution of BlackCat?

Cicada3301 ransomware is attacking companies in North America and Europe with a sophisticated form of ransomware resembling BlackCat. Cicada3301 is a ransomware-as-a-service (RaaS) operation which emerged in June 2024, shortly after the ALPHV/BlackCat ransomware group performed an exit scam in March 2024 after stealing a $22 million ransom from one of their affiliates. Cybersecurity researchers believe that Cicada3301 may be an offshoot of the BlackCat group based on the similarities in techniques between the two (2) threat actors. Both forms of ransomware are written in Rust, use the encryption algorithm, perform identical virtual machine (VM) shutdown and snapshot-wiping commands, use intermittent encryption on larger files, and use the same file naming convention and ransom note decryption method. Cicada3301's ransomware includes both Windows and Linux/VMware ESXi encryptors.