Cybersecurity researchers have uncovered the details of a new ransomware variant named Cicada3301, which exhibits notable similarities to the now-defunct BlackCat (also known as ALPHV) operation.
According to a technical report by cybersecurity firm Morphisec, shared with The Hacker News, Cicada3301 primarily targets small to medium-sized businesses (SMBs) through opportunistic attacks, exploiting vulnerabilities as the initial entry point.
First spotted in June 2024, Cicada3301 is written in Rust and is capable of targeting both Windows and Linux/ESXi systems. The ransomware made its debut by inviting potential affiliates to join its ransomware-as-a-service (RaaS) platform via an advertisement on the RAMP underground forum.
One of the unique features of Cicada3301 is that its executable contains the compromised user's credentials, which are then utilized to run PsExec, a legitimate tool that enables remote execution of programs.
Cicada3301 shares several characteristics with BlackCat, including its use of the ChaCha20 encryption algorithm, the fsutil tool to evaluate symbolic links and encrypt redirected files, and IISReset.exe to halt IIS services and encrypt files that would otherwise be locked for modification or deletion.
Other similarities include actions taken to delete shadow copies, disable system recovery by manipulating the bcdedit utility, increase the MaxMpxCt value to support higher volumes of traffic (such as SMB PsExec requests), and clear all event logs using the wevtutil utility.
Additionally, Cicada3301 has been observed stopping locally deployed virtual machines (VMs), a tactic previously seen in the Megazord and Yanluowang ransomware. It also terminates various backup and recovery services, as well as a hard-coded list of dozens of processes.
During its encryption process, the ransomware avoids certain files and directories but targets a total of 35 specific file extensions, including sql, doc, rtf, xls, jpg, jpeg, psd, and more.
Morphisec's investigation also uncovered additional tools like EDRSandBlast, which weaponizes a vulnerable signed driver to bypass Endpoint Detection and Response (EDR) systems, a technique previously adopted by the BlackByte ransomware group.
These findings come on the heels of Truesec's analysis of the ESXi version of Cicada3301, which also uncovered signs that the group might have collaborated with the operators of the Brutus botnet to gain initial access to enterprise networks.
"Whether Cicada3301 is a rebrand of ALPHV, developed by the same person behind ALPHV, or just copied parts of ALPHV, the timeline suggests that the downfall of BlackCat, the rise of the Brutus botnet, and the emergence of Cicada3301 could all be interconnected," noted the company.
In attacks against VMware ESXi systems, Cicada3301 employs intermittent encryption for files larger than 100 MB and uses a parameter named "no_vm_ss" to encrypt files without shutting down the virtual machines on the host.
The appearance of Cicada3301 has even led to a response from a similarly named "non-political movement" known for cryptographic puzzles, which clarified that it has no association with the ransomware scheme.
