By Huseyin Can YUCEEL & Picus Labs August 22, 2022 Ransomware

The Black Basta group is a newcomer to the Ransomware-as-a-Service (RaaS) market and has already impacted nearly 50 victims. The ransomware group cooperates with QuakBot (Qbot) malware operators to distribute their ransomware. The Black Basta group has different ransomware variants capable of impacting Windows, Linux, and ESXi VM images. The ransomware group uses the double extortion method and exfiltrates the victim’s sensitive data before encrypting it. In a notable series of cyber attacks, the Black Basta group stole and encrypted PII data belonging to members of the American Dental Association, New York, Virginia, and Florida State Dental Associations.

Metadata

Associated Groups	-
Associated Country	Russia
First Seen	April 2022
Target Sectors	Automotive, Construction, Cosmetics, Energy, Healthcare, Heating, Manufacturing, Pharmaceuticals, Plumbing, Telecommunication, Transportation, Textile
Target Countries	United States, Australia, Canada, India, New Zealand, Singapore, United Arab Emirates, United Kingdom

Modus Operandi

Business Models	Ransomware-as-a-service (RaaS) Double Extortion
Extortion Tactics	File Encryption Data Leakage
Initial Access Methods	Exploit Public-Facing Application Phishing External Remote Services
Impact Methods	Data Encryption Data Exfiltration

Exploited Applications and Vulnerabilities by Black Basta

Application	Vulnerability	CVE	CVSS
Windows Print Spooler	Remote Code Execution	CVE-2021-34527	8.8 High

Utilized Tools and Malware by Black Basta

MITRE ATT&CK Tactic	Tools
Initial Access	QakBot
Execution	Cobalt Strike
Persistence	Cobeacon Backdoor
Privilege Execution	Mimikatz
Defence Evasion	Coroxy bcdedit
Discovery	Cobalt Strike
Lateral Movement	netcat
Exflitration	Mega Google Drive
Impact	vssadmin Black Basta Ransomware

[1] F. Fkie, “QakBot (Malware Family).” [Online]. Available: https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot. [Accessed : Jul. 07, 2022]
[2] K. Arhart, “Cobalt Strike,” Cobalt Strike Research and Development, Aug. 19, 2021. https://www.cobaltstrike.com/ (accessed Jul. 06, 2022).
[3] “Backdoor.Win32.COBEACON.A.” [Online]. Available: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/backdoor.win32.cobeacon.a. [Accessed: Jul. 07, 2022]
[4] “GitHub - gentilkiwi/mimikatz: A little tool to play with Windows security,” GitHub. https://github.com/gentilkiwi/mimikatz (accessed Jul. 06, 2022).
[5] “Trojan.Win32.COROXY.A.” [Online]. Available: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.coroxy.a/. [Accessed: Jul. 07, 2022]
[6] H. C. Yüceel, “MITRE ATT&CK T1490 Inhibit System Recovery - The Ransomware’s Favorite.” https://www.picussecurity.com/resource/mitre-attck-t1490-inhibit-system-recovery-the-ransomwares-favorite (accessed Jul. 06, 2022).
[7] G. Giacobbi, “The GNU Netcat -- Official homepage.” [Online]. Available: http://netcat.sourceforge.net. [Accessed: Jul. 07, 2022]
[8] S. Özarslan, “MITRE ATT&CK T1003 Credential Dumping.” https://www.picussecurity.com/resource/blog/picus-10-critical-mitre-attck-techniques-t1003-credential-dumping (accessed Jul. 05, 2022).
[9] F. Fkie, “Black Basta (Malware Family).” [Online]. Available: https://malpedia.caad.fkie.fraunhofer.de/details/win.blackbasta. [Accessed: Jul. 07, 2022]

Black Basta Ransomware Gang

Emerging Threat

Palo Alto CVE-2024-0012 and CVE-2024-9474 Vulnerabilities Explained

Emerging Threat

Understanding and Mitigating Midnight Blizzard's RDP-Based Spear Phishing Campaign

Emerging Threat

CVE-2024-47575: FortiManager Missing Authentication Zero-Day Vulnerability Explained

Emerging Threat

Iranian Cyber Actors’ Brute Force and Credential Access Attacks: CISA Alert AA24-290A

Emerging Threat

CISA Alert AA24-249A: Russian GRU Unit 29155 Targeting U.S. and Global Critical Infrastructure

Emerging Threat

CVE-2024-38063: Remote Kernel Exploitation via IPv6 in Windows

Emerging Threat

RansomHub Ransomware Analysis, Simulation, and Mitigation - CISA Alert AA24-242A

Emerging Threat

Pioneer Kitten: Iranian Threat Actors Facilitate Ransomware Attacks Against U.S. Organizations

Emerging Threat

Andariel: North Korean APT Group Targets Military and Nuclear Programs

Platform

I want to

Use Cases

Frameworks

RESEARCH

LEARNING

RESOURCES

LEARNING

COMPANY

PARTNERS

Black Basta Ransomware Gang

Share this article:

Share this article:

Emerging Threat

Palo Alto CVE-2024-0012 and CVE-2024-9474 Vulnerabilities Explained

Emerging Threat

Understanding and Mitigating Midnight Blizzard's RDP-Based Spear Phishing Campaign

Emerging Threat

CVE-2024-47575: FortiManager Missing Authentication Zero-Day Vulnerability Explained

Emerging Threat

Iranian Cyber Actors’ Brute Force and Credential Access Attacks: CISA Alert AA24-290A

Emerging Threat

CISA Alert AA24-249A: Russian GRU Unit 29155 Targeting U.S. and Global Critical Infrastructure

Emerging Threat

CVE-2024-38063: Remote Kernel Exploitation via IPv6 in Windows

Emerging Threat

RansomHub Ransomware Analysis, Simulation, and Mitigation - CISA Alert AA24-242A

Emerging Threat

Pioneer Kitten: Iranian Threat Actors Facilitate Ransomware Attacks Against U.S. Organizations

Emerging Threat

Andariel: North Korean APT Group Targets Military and Nuclear Programs

Get the Latest InsightsDelivered Straight to Your Inbox

Get the Latest Insights
Delivered Straight to Your Inbox