Black Basta Ransomware: What You Need to Know

216.73.216.86

Black Basta Ransomware: What You Need to Know

· Published 20/09/2024 11:21 · Modified 20/09/2024 11:41

Essential information

Published: 20/09/2024 11:21
Modified: 20/09/2024 11:41
Tags: 2024-09-20 black basta ransomware
Related entities: 6 vulnerabilities (cve), 82 observables, 1 intrusion sets (apt), 15 techniques (mitre), 7 malware, 3 others

Description

Black Basta is a ransomware-as-a-service group that emerged in April 2022, known for double extortion tactics. They target organizations globally, particularly in North America, Europe, and Australia, affecting over 500 entities across various industries. Initial access is gained through phishing, Qakbot, Cobalt Strike, and vulnerability exploitation. The group uses tools like Mimikatz for credential theft and lateral movement. Their process involves data exfiltration using Rclone, followed by file encryption using the ChaCha20 algorithm. The ransomware disables system defenses, deletes shadow copies, and leaves a ransom note. Black Basta has been linked to the FIN7 threat actor due to similarities in EDR evasion techniques.