BlackCat Ransomware's New SEC Reporting Tactic: Turn Regulations Against Victims

Man Bites Dog: In an unusual twist in cybercrime, the ransomware group BlackCat/ALPHV is manipulating the SEC's new 4-day rule on cyber incident reporting to increase pressure on their victims. This latest maneuver highlights a sophisticated understanding of regulatory impacts in ransomware strategies.

SEC's Ruling Impact: Since July 26, 2023, the SEC has mandated that public companies disclose significant cyber incidents within four days. BlackCat, known for their Ransomware as a Service (RaaS) model, is exploiting this rule. They recently claimed to have extracted sensitive data on November 7, 2023, necessitating a report by November 11 under SEC regulations. BlackCat's strategy includes a 24-hour ultimatum for ransom payment, intensifying pressure on the victim.

BlackCat's Evolving Tactics: Already notorious for triple extortion tactics, BlackCat's strategies range from encryption and DoS attacks to data theft and threats of public exposure. This new method of filing reports to the SEC on behalf of their victims is a clever yet alarming escalation in their extortion playbook.

Understanding the SEC Rule: The SEC rule requires businesses to disclose the nature, scope, and timing of a cyberattack, along with its potential impact. This new strategy by BlackCat underscores the necessity for companies to be vigilant and proactive in their cybersecurity measures.

The Upshot: Ransomware gangs will use—any—pressure tactic to get money out of their victims. An ounce of prevention is worth a pound of cure. Train your workforce.

A Master Class on IT Security: Roger Grimes Teaches Ransomware Mitigation

Cyber-criminals have become thoughtful about ransomware attacks; taking time to maximize your organization’s potential damage and their payoff. Protecting your network from this growing threat is more important than ever

Join Roger Grimes, Data-Driven Defense Evangelist at KnowBe4, for this thought-provoking webinar to learn what you can do to prevent, detect, and mitigate ransomware. You'll learn:

How to detect ransomware programs, even those that are highly stealthy

Official recommendations from the Cybersecurity & Infrastructure Security Agency (CISA)

The policies, technical controls, and education you need to stop ransomware in its tracks

Why good backups (even offline backups) no longer save you from ransomware