Dissecting the Cicada - In the shadow of the Black Cat

The talk follows an incident response case from autumn 2024, when a small company with fewer than 50 servers was hit by a previously unseen ransomware group calling itself Cicada 3301. The initial access came from brute-forced remote desktop credentials, followed by a remote support tool used for persistence, internal scanning, data exfiltration and encryption. The speakers explain that the Rust-compiled ESXi locker shares a lot with BlackCat, including its key handling, the way it shuts down virtual machines and deletes snapshots, its service and process kill lists, and a Windows safe-mode technique. Infrastructure overlaps and a shared virtual machine image pointed toward a link to the BlackCat operation.

The middle section widens the picture. It covers a remote desktop server that appeared on the same IP address, the timeline of a ransomware-as-a-service launch as seen through forum posts and victim leak sites, and an escrow deposit on a Russian-language cyber crime forum. A developer who advertised Rust malware work was shown receiving a Bitcoin payment, and a password-spraying botnet called Brutus offers a possible source for the initial access. The speakers stress that the evidence is circumstantial rather than conclusive.

The takeaway is a method: combine reverse engineering, infrastructure pivots and forum research into one timeline, because that gives a fuller picture than any single source. The talk also argues that public exposure of these operations can slow a group's recruitment and make it harder for affiliates to trust it.