Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware
Essential information
- Published
- 09/12/2024 22:32
- Modified
- 11/12/2024 17:09
- Tags
- 2024-12-09 blackbasta darkgate ransomware zbot
- Related entities
- 72 observables, 1 intrusion sets (apt), 14 techniques (mitre), 3 malware
Description
A resurgence of activity related to the Black Basta ransomware campaign has been observed since early October. The threat actors have refined their tactics, introducing new malware payloads, improved delivery methods, and enhanced defense evasion techniques. The attacks begin with email bombing of target users, followed by social engineering attempts via Microsoft Teams. Operators impersonate IT staff and trick users into installing remote management tools. Once access is gained, they deploy credential harvesters, Zbot, DarkGate, and custom malware. The campaign has been linked to Black Basta ransomware deployments in the past, highlighting its serious nature. The attackers continue to update their strategies and tools rapidly, demonstrating sophisticated and persistent threat behavior.