IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

CISA, FBI and NSA publish BlackMatter ransomware warning

The agencies are warning organisations about the attacks which they say have been used in the past to target US critical infrastructure

The CISA, FBI, and NSA have published a cyber security advisory warning organisations of BlackMatter ransomware attacks which have targeted multiple US critical infrastructure entities in the food and agriculture sector.

The organisations underlined that BlackMatter, first seen in July 2021, is a ransomware as a service (RaaS) tool which cyber actors have used to access a network and remotely encrypt host and shared drives. The developers who sell the tool are able to profit from cyber criminal affiliates who deploy it, said the advisory.

The agencies underlined that ransomware attacks against critical infrastructure entities could directly affect consumer access to these services, which is why the CISA, FBI, and NSA have urged all organisations to implement a number of mitigations to help organisations reduce the risk of compromise from BlackMatter ransomware attacks.

The mitigations include implementing and enforcing backup procedures, using strong unique passwords, using multi-factor authentication, and implementing network segmentation and traversal monitoring.

“This advisory highlights the evolving and persistent nature of criminal cyber actors and the need for a collective public and private approach to reduce the impact and prevalence of ransomware attacks,” said Eric Goldstein, executive assistant director for Cybersecurity at the CISA.

Related Resource

The best defence against ransomware

How ransomware is evolving and how to defend against it

Blue padlock Free download

“CISA, FBI and NSA are taking every step possible to try to make it harder for cyber criminals to operate. Americans can help us in this long-term endeavor by visiting Stopransomware.gov to learn how to reduce their risk of becoming a victim of ransomware.”   

Bryan Vorndran, assistant director of the FBI’s Cyber Division, highlighted the need for organisations to report any ransomware incidents by contacting their local FBI Field Office and speaking to a cyber agent.

“By reporting a cyber incident, targeted entities are enhancing our ability to respond and investigate with the goal of disrupting cybercriminal operations,” he said.

In September, the BlackMatter ransomware group hit New Cooperative, an Iowa-based farming cooperative, with a $5.9 million ransom demand. The gang had obtained financial documents, networking information, employee social security numbers, and the source code for a farmer technology platform from the cooperative. The timing of the attack made it crucial for the organisation to get its systems back online as soon as possible as the harvesting season was about to begin.

Featured Resources

How to hold more productive meetings

Tips and tricks to get the most out of your meetings

Free Download

Enabling the future of work with embedded real-time communication

A new dimension of human interaction is coming to digital work

Free Download

How to do hybrid work right

Overcoming challenges in the transition to hybrid work

Watch now

HCI 2.0 From HPE: How it can help your business thrive

Why SMBs need to accelerate digital transformation with HCI

Free download

Recommended

AWS’ Amplify Studio is now generally available 
Development

AWS’ Amplify Studio is now generally available 

22 Apr 2022
TSMC founder brands Intel’s US expansion plans an ‘exercise in futility’
components

TSMC founder brands Intel’s US expansion plans an ‘exercise in futility’

22 Apr 2022
Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT
ransomware

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT

13 Apr 2022
Google to invest $9.5 billion in US offices and data centres this year
data centres

Google to invest $9.5 billion in US offices and data centres this year

13 Apr 2022

Most Popular

Windows Server admins say latest Patch Tuesday broke authentication policies
Server & storage

Windows Server admins say latest Patch Tuesday broke authentication policies

12 May 2022
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

13 May 2022
How full-stack observability can accelerate IT innovation
Sponsored

How full-stack observability can accelerate IT innovation

3 May 2022