Monero and Bitcoin Ransomware Group Targets Italian Asset Manager

Cybercriminal group BlackCat attempted to attack Azimut, but largely failed.

Italian asset management firm Azimut has been targeted by the international ransomware group BlackCat, Reuters reported on July 24.

The company disclosed the cyber attack that day, Reuters said, adding that it had rejected any demand to pay the ransom.

The company said the attack did not compromise customer data, saying:

"The attack did not affect data or information that could have allowed access to clients' and financial advisors' personal positions or the execution of unauthorized transactions."

Azimut detected unauthorized access to its IT systems during routine monitoring, quickly notified the relevant authorities and activated internal security procedures, successfully limiting the impact of the attack.

Israeli cybersecurity startup DarkFeed and California-based cybersecurity firm Palo Alto Networks both identified BlackCat as the group behind the attack, with the latter saying BlackCat stole more than 500 GB of data from Azimut.

BlackCat is known to use cryptocurrency

Due to the relative difficulty of tracking blockchain transactions, most ransomware groups rely on cryptocurrencies for payments.

BlackCat is no exception, with cybersecurity firm SafeBreach saying in 2022 that the group is demanding ransom payments ranging from $400,000 to $3 million in Monero (XMR) and Bitcoin (BTC). It also advises that victims must pay an additional 15% fee if they pay with Bitcoin.

The organization may charge extra because Bitcoin has fewer privacy features than Monero. In order to ensure the privacy of illegal bitcoin transactions, BlackCat needs to launder money and pay related fees through coin mixers. A separate report from the U.S. Department of Health and Human Services’ Cybersecurity Division indicated that the group was indeed moving bitcoin through mixers.

Despite BlackCat’s reliance on cryptocurrencies, the Reuters report did not mention cryptocurrencies or the amount BlackCat requested from Azimut.

Incidentally, Azimut itself has invested in blockchain ventures, including mining firm Alps Blockchain and asset management firm Diaman Partners, which is partially focused on cryptocurrencies.

There is no indication that these actions are related to BlackCat's decision to target the company, as the cybercriminal group has targeted various non-crypto groups. Most recently, the group claimed to have launched an attack on cosmetics company Estelle Lauder.