NOTE: I don’t normally write posts like this, but I might have been bored. If you find value in this article, let me know and maybe I’ll write more like it.

Introduction

Black Basta is a relatively new ransomware group that emerged around April 2022, and they’ve been in the news ever since. This morning, SecurityWeek (and others) announced that Black Basta has hit 500+ organizations, and the U.S. government is issuing new warnings. . The group has quickly become notable for its aggressive tactics and significant impacts on its victims, which include a variety of organizations across multiple sectors. The group is a ransomware operator and a Ransomware-as-a-Service (RaaS) criminal enterprise.

Here are key aspects of Black Basta and its operations.

Modus Operandi

• Double Extortion: Black Basta is known for employing a double extortion tactic. This means that they not only encrypt the victim’s data but also steal it. After the data theft, they threaten to leak the stolen information on their leak site if the ransom is not paid, putting additional pressure on the victims to comply with their demands.
• Ransomware Deployment: The group uses phishing emails with malicious attachments or exploits known vulnerabilities to gain initial access to the target network. Once inside, they escalate privileges and move laterally across the network to deploy the ransomware broadly.
• Ransom Notes: After encrypting files, Black Basta typically leaves a ransom note with instructions on how to contact them via a dark web portal and the steps to follow to pay the ransom for decrypting the files.

Initial Attack Vector

The initial attack vector for Black Basta ransomware typically involves several different approaches:

1. Phishing Emails: Phishing campaigns are commonly used, where attackers send emails that appear legitimate but contain malicious attachments or links. These emails may include a Microsoft Excel spreadsheet that, when opened, executes malicious PowerShell commands​ (Darktrace)​.
2. Exploitation of Vulnerabilities: Black Basta may also gain access through vulnerabilities exposed to the internet, exploiting these weaknesses to infiltrate an organization’s network​ (Darktrace)​.
3. Use of Initial Access Brokers: The group is known to work with initial access brokers who already have a foothold within the target’s network. These brokers provide the ransomware operators with access, bypassing the need for initial reconnaissance and direct exploitation​ (Darktrace)​.
4. Targeted Attacks: Black Basta is known for its highly targeted attacks rather than broad, indiscriminate campaigns. This approach involves careful planning and often exploits specific vulnerabilities within the targeted organization’s infrastructure​ (Proven Data)​.

Each of these methods allows Black Basta to effectively infiltrate systems, establish a presence, and execute their ransomware, making it crucial for organizations to maintain robust phishing defenses, regularly patch and update systems, and monitor network activity for signs of unauthorized access.

Technical Characteristics

• Encryption: The ransomware uses strong encryption algorithms to lock files, making it difficult to decrypt the files without the cryptographic keys held by the attackers.
• File Marker: Encrypted files are often appended with a specific file extension, which has varied in different attacks but serves as a marker of Black Basta’s activity.
• Speed and Efficacy: Reports suggest that Black Basta’s ransomware can encrypt systems quickly and effectively, minimizing the window for defensive actions by the targeted organizations’ IT security teams.

Attribution Speculation

While the exact origins and affiliations of Black Basta are unclear, some cybersecurity researchers speculate that the group might have links to other established cybercrime groups, possibly including those behind previously well-known ransomware campaigns. This speculation is often based on similarities in techniques, procedures, and the malware code used.

NOTE: Some researchers assume that Black Basta’s core leadership group originates from the (now defunct) Conti Group. Conti was a Russian-affiliated organization formed in the late 2010s and was dissolved in mid 2022.

Impact

Since its emergence, Black Basta has reportedly compromised numerous organizations, with impacts ranging from operational disruptions to significant financial losses due to downtime and ransom payments. The group has successfully targeted organizations in various industries, underscoring its broad threat profile.

Known Victims

Black Basta ransomware has targeted several high-profile organizations across various industries, demonstrating its significant impact and the wide range of its attacks. To date (mid-May 2024), more than 500 organizations have been hit by Black Basta.

Notable victims of Black Basta include:

• Capita: A UK-based business process outsourcing and professional services company, which experienced a disruptive ransomware attack attributed to Black Basta. Despite initial understatements about the severity of the incident, the attack caused considerable operational disruptions​ (SecurityWeek)​.
• American Dental Association (ADA): The ADA was hit by a ransomware attack in April 2022, during which Black Basta claimed responsibility and leaked sensitive data including W2 forms and accounting spreadsheets. This attack highlighted the vulnerability of organizations even in specialized sectors like healthcare​ (ConnectWise)​.
• Knauf: A global leader in the building materials industry, Knauf also fell victim to Black Basta. The ransomware group confirmed their responsibility by posting a portion of the stolen data online, causing significant operational challenges for the company​ (ConnectWise)​.
• Maple Leaf Foods: A major Canadian food processing company, which was among the several enterprises that Black Basta successfully infiltrated and compromised​ (SecurityWeek)​.
• Thales: A French multinational company that operates in the aerospace and defense sectors among others, which was also targeted by Black Basta, showcasing the ransomware group’s reach into critical infrastructure sectors​ (SecurityWeek)​.

Additional targets include:

• VMware: Black Basta targeted VMware, particularly focusing on Linux-based VMware ESXi virtual machines, which are used widely for enterprise virtualization.
• Transportation Companies: Organizations within the transport sector have also fallen victim to Black Basta, reflecting the group’s broad target spectrum.
• Government Agencies: Various government entities have been compromised, highlighting the ransomware’s threat even to highly secured networks.
• Manufacturing Companies: The manufacturing sector has not been spared, with multiple companies experiencing disruptions due to these ransomware attacks.
• Utilities: Critical infrastructure sectors such as utilities have been affected, which poses a significant concern given the essential services they provide.

These cases show that Black Basta does not discriminate by industry, targeting a wide range of sectors and demonstrating the necessity for robust cybersecurity measures across all types of organizations.

Basic Indicators of Compromise (IOCs)

Here are some of the key Indicators of Compromise (IOCs) associated with Black Basta ransomware, based on the gathered details:

File Extensions

• .basta: Typically associated with newer versions of Black Basta.
• .ransom: Used in older versions of the ransomware.

Ransom Note

Filename: readme.txt – This file contains instructions for the victim on how to proceed with paying the ransom and may also include links to communication channels operated by the attackers.

IP Addresses and Domains

• IP address: 212.118.55.211 – This IP address has been flagged in the context of ransomware communication.
• Domain: faceappinc[.]com – Used as a command and control (C2) server by the attackers.
• Domain: dataspt[.]com – Observed during data exfiltration activities.

Malicious Files

• Filename: syncro.exe – While it can be a legitimate file, in the context of Black Basta, it has been used maliciously to spread the infection.
• Filename: management.exe – Often written to the Temp directory on infected devices, indicating system compromise.

Network Behavior

• Port Usage: Unusual port, 2022, observed during exfiltration activities.
• SMB Activity: Notable for writing suspicious files like delete.me and covet.me across the network during lateral movement phases.

Encryption Characteristics

Encryption Algorithm: Black Basta uses the XChaCha20 encryption algorithm, noted for its security and efficiency. In some versions, encryption keys can potentially be extracted due to flaws in the encryption routine.

These IOCs can help IT security teams detect potential Black Basta ransomware infections by monitoring for these specific file extensions, network behaviors, and communications with the noted IP addresses and domains. Regularly updating antivirus and endpoint detection solutions with these IOCs can provide early detection and potentially mitigate the impact of an attack​.

Prevention and Response

• Awareness and Training: Organizations are advised to train employees on recognizing phishing attempts and other common entry points for ransomware.
• Vulnerability Management: Regularly updating and patching systems to close off vulnerabilities that could be exploited by ransomware operators.
• Data Backups: Maintaining regular, secure, and isolated backups of critical data to enable recovery in the event of a ransomware attack.
• Incident Response Plan: Developing and regularly updating an incident response plan that includes specific procedures for responding to ransomware attacks.

Given its rapid rise and the sophistication of its operations, Black Basta is considered a significant threat in the landscape of cybersecurity threats. Organizations are encouraged to adopt comprehensive cybersecurity measures and remain vigilant against such evolving ransomware threats.

Additional Information

• CISA and Partners Release Advisory on Black Basta Ransomware – https://www.cisa.gov/news-events/alerts/2024/05/10/cisa-and-partners-release-advisory-black-basta-ransomware
• Black Basta Ransomware Hit Over 500 Organizations – https://www.securityweek.com/black-basta-ransomware-hit-over-500-organizations/
• Fresh Black Basta TTPs revealed as CISA says CNI hit – https://www.thestack.technology/black-basta-ttps/
• Open Threat Exchange