These variations can create challenges for network defenders.

Based on comparative analysis of the tools, while data exfiltration is the consistent operational objective, the path to achieve that objective and the supporting functionality of each exfiltration tool varies slightly based on configuration, implementation details, and the operational environment.

Since their original discovery, Accenture Security has observed modified versions of the tools utilized in multiple ransomware incidents involving BlackCat (aka ALPHV) and LockBit operators, as well as recent adoption by Conti operators, from the fourth quarter of 2021 and the first quarter of 2022.

A testament to their functionality and effectiveness, these tools have gained popularity across the ransomware and extortion ecosystem.

Discovered in 2021, StealBit and ExMatter are custom exfiltration tools that were originally known to be utilized by LockBit and BlackMatter ransomware operations, respectively.

We will provide a comparative and temporal analysis of the tools and the ongoing utilization and development efforts observed over time. In this blog, we will examine two (2) exfiltration toolsets identified during CIFR incident response engagements conducted between the fourth quarter of 2021 and the first quarter of 2022: StealBit and ExMatter.

The continued use and development of these custom tools is a testament to their success, often simplifying and accelerating data exfiltration. In addition to using ubiquitous tools such as Rclone, MegaSync, and FileZilla, ransomware and extortion groups have crafted custom exfiltration tools tailored to their operations.

In the proliferation of Ransomware as a Service (RaaS) operations as showcased by our previous blog, “Diving into double extortion campaigns”, tools to aid data exfiltration tactics have become a commodity.

Filezilla malware 2019