BlackCat/ALPHV Gang Adds Wiper Functionality as Ransomware Tactic

Using its Exmatter tool to corrupt rather than encrypt files signals a new direction for financially motivated cybercrime activity, researchers say.

Malware wielded by BlackCat/ALPHV is putting a new spin on the ransomware game by deleting and destroying an organizations data rather than merely encrypting it. The development provides a glimpse of the direction in which financially motivated cyberattacks likely are heading, according to researchers.
Researchers from security firms Cyderes and Stairwell have observed a .NET exfiltration tool being deployed in relation to BlackCat/ALPHV ransomware called Exmatter that searches for specific file types from selected directories, uploads them to attacker-controlled servers, and then corrupts and destroy the files. The only way to retrieve the data is by purchasing the exfiltrated files back from the gang.
Data destruction is rumored to be where ransomware is going to go, but we haven’t actually seen it in the wild, according to a
blog post
published recently on the Cyderes website. Exmatter could signify that the switch is happening, demonstrating that threat actors are actively in the process of staging and developing such capability, researchers said.
Cyderes researchers performed an initial assessment of Exmatter, then Stairwells Threat Research Team discovered partially-implemented data destruction functionality after analyzing the malware, according
to a companion blog post
.
The use of data destruction by affiliate-level actors in lieu of ransomware-as-a-service (RaaS) deployment would mark a large shift in the data extortion landscape, and would signal the balkanization of financially-motivated intrusion actors currently working under the banners of RaaS affiliate programs, Stairwell threat researcher Daniel Mayer and Shelby Kaba, director of special operations at Cyderes, noted in the post.
The emergence of this new capability in Exmatter is a reminder of the rapidly evolving and increasingly sophisticated threat landscape as threat actors pivot to find more creative ways to criminalize their activity, notes one security expert.
Contrary to popular belief, modern attacks are not always just about stealing data, but can be about destruction, disruption, data weaponization, disinformation, and/or propaganda, Rajiv Pimplaskar, CEO of secure communications provider Dispersive Holdings, tells Dark Reading.
These ever-evolving threats demand that enterprises also must sharpen their defenses and deploy advanced security solutions that harden their respective attack surfaces and obfuscate sensitive resources, which will make them difficult targets to attack in the first place, Pimplaskar adds.
The researchers analysis of Exmatter is not the first time a tool of this name has been associated with BlackCat/ALPHV. That group — believed to be run by former members of various ransomware gangs, including those from now-defunct
BlackMatter
— used Exmatter to exfiltrate data from corporate victims last December and January, before deploying ransomware in a double extortion attack, researchers from Kaspersky
reported previously
.
In fact, Kaspersky used Exmatter, also known as Fendr, to link BlackCat/ALPHV activity with that of
BlackMatter

in the threat brief
, which was published earlier this year.
The sample of Exmatter that Stairwell and Cyderes researchers examined is a .NET executable designed for data exfiltration using FTP, SFTP, and webDAV protocols, and contains functionality for corrupting the files on disk that have been exfiltrated, Mayer explained. That aligns with BlackMatters tool of the same name.
Using a routine named Sync, the malware iterates through the drives on the victim machine, generating a queue of files of certain and specific file extensions for exfiltration, unless they are located in a directory specified in the malware’s hardcoded blocklist.
Exmatter can exfiltrate queued files by uploading them to an attacker-controlled IP address, Mayer said.
The exfiltrated files are written to a folder with the same name as the victim machine’s hostname on the actor-controlled server, he explained in the post.
The data-destruction process lies within a class defined within the sample named Eraser that is designed to execute concurrently with Sync, researchers said. As Sync uploads files to the actor-controlled server, it adds files that have been successfully copied to the remote server to a queue of files to be processed by Eraser, Mayer explained.
Eraser selects two files randomly from the queue and overwrites File 1 with a chunk of code thats taken from the beginning of the second file, a corruption technique that may be intended as an evasion tactic, he noted.
The act of using legitimate file data from the victim machine to corrupt other files may be a technique to avoid heuristic-based detection for ransomware and wipers, Mayer wrote, as copying file data from one file to another is much more plausibly benign functionality compared to sequentially overwriting files with random data or encrypting them. Mayer wrote.
There are a number of clues to indicate that Exmatters data-corruption technique is a work in progress and thus still being developed by the ransomware group, the researchers noted.
One artifact in the sample that points to this is the fact that the second file’s chunk length, which is used to overwrite the first file, is randomly decided and could be as short as 1 byte long.
The data-destruction process also has no mechanism for removing files from the corruption queue, meaning that some files may be overwritten numerous times before the program terminates, while others may never have been selected at all, the researchers noted.
Moreover, the function that creates the instance of the Eraser class — aptly named Erase — does not appear to be fully implemented in the sample that researchers analyzed, as it does not decompile correctly, they said.
Developing
data-corruption and destruction capabilities
in lieu of encrypting data has a number of benefits for ransomware actors, the researchers noted, especially as data exfiltration and double-extortion (i.e., threatening to leak stolen data) has become a rather common behavior of threat actors. This has made developing stable, secure, and fast ransomware to encrypt files redundant and costly compared to corrupting files and using the exfiltrated copies as the means of data recovery, they said.
Eliminating encryption altogether also can make the process faster for RaaS affiliates, avoiding scenarios in which they lose profits because victims find other ways to decrypt the data, the researchers noted.
These factors culminate in a justifiable case for affiliates leaving the RaaS model to strike out on their own, Mayer observed, replacing development-heavy ransomware with data destruction.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
BlackCat/ALPHV Gang Adds Wiper Functionality as Ransomware Tactic