BlackCat ransomware includes data leak API to its tactic

The BlackCat ransomware gang is currently attempting to create more leverage against their targets to acquire a ransom. Based on reports, the group provides an API for their data leak website to increase the visibility of their attacks.

This sudden strategy shift from the group follows their recent failed campaign of extorting a company that completely ignored their threats.

 

The BlackCat ransomware includes a new page for using their API.

 

Earlier this week, the BlackCat ransomware included a new page in its data leak website, which displays its API that gathers updates about its recent victims.

The Application Programming Interface (API) is a kit for enabling communication between two software components based on agreed definitions and commands.

A researcher noticed that the new section of the ALPHV’s site appears to be partially available for months but limited to a smaller audience.

The ransomware group published the API calls that could help recover information about new victims included in their leaked website or updates starting a particular data.

The ransomware group explained that users could fetch updates from the start and sync each article with the users’ database. After this process, subsequent updates should provide the latest updates on the ransomware group’s activity.

Furthermore, the group provided a crawler coded in Python that aids users in retrieving the latest information on the data leak website.

The ransomware group did not provide details about creating their new page. However, researchers believe that the lack of victims that give attention to BlackCat’s provocation is why the attackers included a new extortion tactic.

Recent research revealed that the number of paying victims that suffered a ransomware attack dwindled in the second quarter of 2023. However, some threat actors continue to make substantial amounts of profit by targeting the supply chain to infiltrate numerous organisations worldwide.

Ransomware gangs are now developing new malicious strategies to put more pressure on and earn funds despite fewer victims paying a ransom. Therefore, some groups immediately leak stolen information to a larger audience to have added leverage against their victims.