Threat Intelligence Report April 9 - April 15 2024

Black Basta Ransomware Group

Black Basta, discovered in early 2022, is known for its tricky double extortion tactic. This group, speaking Russian, doesn't just lock up computers with ransomware; they also sneak out private information and threaten to publish it if the victim doesn't pay up. The way they work is similar to other cyber gangs like Conti and BlackMatter, leading some to think they might be connected. Although they're not big on recruiting or advertising online, they're still a big threat. It's important for people to know about them and take steps to stay safe.

Tactics, Techniques, and Procedures (TTPs):

Double Extortion: Black Basta employs the double extortion tactic. They encrypt victim data and demand a ransom for decryption. Additionally, they steal sensitive information and threaten to leak it publicly if the ransom is unpaid.

Targeted Attacks: Black Basta appears to target specific victims rather than using a widespread approach.

Exploited Vulnerabilities (CVEs):

Recent ScreenConnect Vulnerabilities (CVE-2024-1708 & CVE-2024-1709): These recently discovered vulnerabilities (February 2024) in ConnectWise ScreenConnect software (versions 23.9.7 and earlier) allow attackers to bypass authentication and potentially gain complete control of the system. Black Basta, along with other ransomware groups, have been actively exploiting these vulnerabilities.

ZeroLogon (CVE-2020-1472): This critical vulnerability in the Netlogon protocol (used for domain authentication in Windows) allows attackers to gain domain administrator privileges. While a patch is available, it's crucial to ensure all systems are updated.

PrintNightmare (CVE-2021-34527): This vulnerability in the Windows Print Spooler service allows privilege escalation. Black Basta has been known to leverage this vulnerability to elevate privileges and deploy additional payloads like Cobalt Strike.

NoPac vulnerabilities (CVE-2021-42278 & CVE-2021-42287): These vulnerabilities in the Microsoft Server Message Block (SMB) protocol can be exploited for privilege escalation.

MSDT Remote Code Execution (CVE-2022-30190): Black Basta variants have been observed exploiting this vulnerability in Microsoft Office documents to achieve remote code execution.

Initial Intrusion Vectors: They gain initial access through various methods, including:

Qakbot Trojan: This malware can steal credentials, download additional payloads, and move laterally within a network.

Brute Force Attacks: They may attempt to crack weak passwords to gain access.

Cobalt Strike: This tool allows for post-exploitation activities like privilege escalation and lateral movement.

Data Exfiltration: Once inside, Black Basta exfiltrates sensitive data to their servers.

Data Leak Site: They maintain a dark web leak site (Basta News) where they threaten to publish stolen data from unpaid victims.

Ransom Note:

Kill Chain:

Indicators of Compromise (IOCs):

Tools used by Blackbasta Ransomware for hacking: