BlackCat ransomware uses new ‘Munchkin’ Linux VM in stealthy attacks

The BlackCat ransomware operation has introduced a new tool called ‘Munchkin’ that uses virtual machines to deploy encryptors covertly on network devices. ‘Munchkin’ allows BlackCat to operate on remote systems and encrypt remote server networks. It also adds another layer of isolation, making it difficult for security software to detect and analyze it. Cybersecurity advisor Unit 42 warns that BlackCat affiliates must delete Munchkin virtual machines to prevent access token leaks.