Black Shrantac Ransomware – LOTL Tactics and Double Extortion on the Rise

Got a question or comment? Message us here!

A new ransomware group is blending in with legitimate tools. This #SOCBrief breaks down Black Shrantac and how to detect it early.

Support the show

Watch full episodes at youtube.com/@aliascybersecurity.
Listen on Apple Podcasts, Spotify and anywhere you get your podcasts.

Episode Transcript

SPEAKER_00 (00:03):
Good morning, good afternoon, or good evening,
whenever you may be.
And welcome to another episodeof the Sock Brief.
This is your go-to podcast forstaying ahead of the
ever-evolving world ofcybersecurity threats.
I'm your host Andrew, and todaywe're going to discuss a newly
observed ransomware group that'sgaining some traction, named

(00:24):
Black Shrantac.
So this group emerged inSeptember of 2025, and it's
continuing to make their markwith living off the land
techniques and classic doubleextortion tactics.
We'll discuss who they are, howthey operate, who they're
targeting, and the practicalsteps your SOC can take to spot
them and stop them before yourorganization becomes the next

(00:46):
headline.
So Black Shrantac is arelatively new ransomware group.
They follow the pretty much nowstandard double extortion model,
which means they're firstexfiltrating sensitive data,
then they're deployingransomware to encrypt systems
and threaten to leak the stoleninformation if the ransom isn't
paid.

(01:06):
The information we have on themnow indicates that they have a
heavy reliance on livingoff-the-land techniques, which
means they're using legitimateadministrative tools already
present on the networks ratherthan bringing in custom malware.
This makes their attacks quieterand harder for traditional EDR
solutions to flag.

(01:27):
So why is this group worthwatching?
Mainly, they're opportunisticand aggressive.
They don't stick to one sectoror region.
They're hitting wherever theconditions are right.
Their reported victims currentlyinclude organizations in
manufacturing, financialservices, technology,
hospitality, public sector, andbusiness services across

(01:51):
multiple geographies.
Their attacks tend to be fastand focused on causing maximum
operational disruption.
By living off the land, BlackShrantak avoids dropping obvious
malware that EDR tools are tunedto catch.
They use built-in Windows toolsfor reconnaissance, lateral
movement, and persistence.

(02:12):
From there, they'll deploy theirencryptor only at the end.
This keeps dwell times low anddetection difficult for a lot of
socks, because it means tryingto discern normal admin activity
being blended in with maliciousbehavior.
It makes it easy to miss thereal threat until the encryption
starts.
For SOCS, getting in front ofthis for any kind of detection,

(02:36):
you want to be on the lookoutfor anonymous use of legitimate
tools, watching for things likeunusual PowerShell, WMI, or
scheduled task activity,especially if it's coming from
unexpected accounts or at oddhours.
Look for signs of dataexfiltration on your firewalls
or SIM logs.

(02:57):
Some of the best defensesagainst these attacks would be
restricting unnecessary admintool usage, enforcing
application allow listing, andmonitoring for living off the
land binaries.
Make sure you're using networksegmentations so you're limiting
lateral movement if an initialfoothold is gained.
For proactive threat hunting,stocks need to search their logs

(03:19):
for recent anomalous adminactivity, unusual protocol
traffic, or rapid fileencryption patterns.
You can always integrate threatintelligence feeds for black
Shrantec IOCs.
There are vendors likeWatchGuard that have already
published details on their TTPsand their extortion sites.
Make sure you're sharing thisinformation internally.

(03:41):
Brief your team and leadership.
Make sure that they're aware andthey know what living off the
land techniques are and whatneeds to be done to counteract
them.
You can always also run atabletop sim with a living
off-the-land ransomwarescenario.
This will help your team andorganization identify any gaps
in security or processes.

(04:03):
And the bottom line here is thatBlack Shrantac shows that
attackers can be really goodwith blending in.
Socks that are aware of andprepared for living off the land
attacks can stop these attacksbefore they become a problem.
Here's a closing thought and acall to action.
This group's rise is a reminderthat ransomware groups in

(04:23):
general will continue to evolveand adjust to today's defenses.
SOCS that have their tools tunedfor the unusual are quick on
blocking risky behaviors, andkeep communication flowing can
help turn potential disastersinto contained incidents.
This week, run one quick huntfor anonymous admin tool usage

(04:44):
in your environment and reviewyour network for any high-value
assets with criticalvulnerabilities.
And that's a wrap for thisepisode of the SOC Brief.
Have questions or have your ownliving off the land attack
stories and want to share?
Hit us up on social media or viaour website.
Keep your eyes open, keepsharpening those skills, and
we'll talk soon.

(05:05):
As always, stay secure outthere.
Bye.