Black Basta ransomware emerges

Black Basta, an emerging ransomware group first observed in April 2022, may be a rebranding of the Conti ransomware group, according to speculation on the dark web. Although little is known for sure, observers note similarities between the two groups’ data leak site infrastructures, payment methods and communication styles. They suspect Black Basta may be run by skilled and experienced ransomware operators. In addition, recently leaked Conti chats indicate Conti operatives may be trying to elude law enforcement by rebranding and working under a new ransomware group.

Impact

Black Basta ransomware slows down machine processes and ultimately makes desktop files unusable before dropping a ransom note. The latest known victims include a German manufacturer of high-quality products for the automotive industry, a California electronics company and an Alabama wholesale tire and battery service.

DXC perspective

A secured infrastructure coupled with a robust cyber defense program that includes regular employee training can help protect your environment from ransomware.

Threat hunting tips

Black Basta’s data leak site can be found at the following Tor address:

stniiomyjliimcgkvdszvgen3eaaoz55hreqqx6o77yvmpwt7gklffqd[.]onion/

Observed Black Basta TTPs

Attack vectors:

• Insecure and vulnerable remote desktop protocol (RDP) configuration
• Phishing campaigns
• Malicious downloads
• Web injections
• Repackaged or infected installers

Compromised machine behavior:

Black Basta slows down machine processes through prolific access to files and threads.

It has also been observed accessing registry keys, initiating file mapping and querying computer information.

Once the encryption process is complete, the malware changes the wallpaper, and files on the desktop become encrypted and unusable.

The ransomware appends encrypted files with .basta and drops a ransom note titled “readme.txt” within directories on the C:\ drive, including the following directories:

●       Program data

●       Perflogs

●       Python27

●       PDFStreamDumper

●       Desktop

Black Basta also bypasses the following directories:

●       Program files

●       Program files (x86)

●       Windows

Final malware steps

The ransomware deletes its shadow copies and disables Windows repair and recovery functions to prevent repairing malware damage.

In the ransom note, operators write that data has been “stolen and encrypted,” and that the victim should contact operators to “decrypt one file for free” by going to the following Tor address:

hxxps://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd[.]onion:80/