blackshrantac Ransomware Group

Key insights

• •Gains initial access by exploiting CVE-2024-3400 in Palo Alto Networks PAN-OS devices and through phishing emails.
• •Utilizes a primary encryptor binary for execution without administrative privileges and leverages legitimate tools for remote access.
• •Employs a double extortion model, exfiltrating sensitive data before encrypting files and demanding ransom.
• •Disables backups and security controls to enhance the effectiveness of their attacks.
• •Uses a leak site on the Tor network to publish victim information and apply pressure through public disclosure threats.