The BlackCat/ALPHV ransomware group has adopted a new weapon called ‘Munchkin,’ which leverages virtual machines to quietly deploy encryption on network devices.
Munchkin empowers BlackCat to function on remote systems and encrypt remote Server Message Block (SMB) or Common Internet File (CIFS) network shares. The integration of Munchkin into BlackCat’s already extensive and sophisticated toolkit enhances its appeal to cybercriminals looking to join the ransomware affiliate program.
BlackCat’s latest Munchkin tool is a customized Alpine OS Linux distribution available as an ISO file. After infiltrating a device, the threat actors install VirtualBox and create a new virtual machine using the Munchkin ISO.
This Munchkin virtual machine contains a suite of scripts and utilities that facilitate password retrieval, lateral movement across the network, the creation of a BlackCat ‘Sphynx’ encryption payload, and the execution of programs on networked computers.
Upon booting, it changes the root password to one known solely to the attackers and utilizes the ‘tmux’ utility to execute a Rust-based malware binary called ‘controller,’ which initiates the loading of scripts used in the attack.
The ‘controller’ operates based on the bundled configuration file, providing access tokens, victim credentials, authentication secrets, configuration directives, folder and file blocklists, tasks to execute, and hosts to target for encryption. This configuration generates customized BlackCat encryption executables in the /payloads/ directory, which are then sent to remote devices to encrypt files or SMB and CIFS network shares.
One common concern for both ransomware victims and cybercriminals is that samples frequently leak through malware analysis sites. Analyzing these samples allows researchers to access the entire negotiation chat between the ransomware group and its victim.
To counteract this, affiliates supply Tor negotiation site access tokens at runtime during launch, preventing access to the victim’s negotiation chat, even if the attack sample is available. As a precaution, threat actors instruct affiliates to delete the Munchkin virtual machines and ISOs to prevent the leakage of these access tokens.
The developers also offer guidance on using ‘Controller’ to monitor the attack’s progress and initiate tasks. Munchkin simplifies the tasks of BlackCat ransomware affiliates, including evading security solutions protecting the victim’s device, thanks to the isolation provided by virtual machines from the operating system, making detection and analysis more challenging for security software.
Moreover, the use of Alpine OS ensures a small digital footprint, and the tool’s automated operations reduce the need for manual intervention and minimize command feed noise.
Lastly, Munchkin’s modularity, which includes various Python scripts, unique configurations, and the ability to swap payloads, makes it highly adaptable to specific targets or campaigns.
To avoid falling victim to such ransomware attacks, organizations can implement robust cybersecurity measures, including regularly update and patch all software and systems to address vulnerabilities, and utilize security solutions that can detect and block suspicious activities and malware.
