Bablock

BabLock, also known as Rorschach, is a type of malware that operates as ransomware. First identified by Check Point Research in April 2023, this harmful software infiltrates computer systems and devices, often without the user's knowledge, with the aim to exploit, damage, and potentially hold data hostage for ransom. It has been observed to transfer over HTTP/S, either during initial infiltration or lateral movement within a network. BabLock has also been seen being emailed as a compressed attachment, another method for both infiltration and lateral movement. The malware has made significant impact globally, with notable incidents including an attack on Chilean telecommunications company GTD. The attack was initially misattributed to the Medusa ransomware, but later analysis by computer security company Eset confirmed it was indeed the work of BabLock. This incident highlighted the malware's ability to disrupt operations and cause significant harm. Moreover, further investigations from Chile's CSIRT revealed that BabLock exploits DLL side-loading flaws in security software such as BitDefender, Trend Micro, and Cortex XDR to facilitate the deployment of its injector. This technique allows the malware to write itself to disk at the host level, making it even more difficult to detect and remove. SafeBreach's coverage of the Rorschach ransomware provides detailed insights into these various tactics, further emphasizing the need for robust cybersecurity measures against this potent threat.