Black Basta Ransomware Group

Actor Type	Criminal Group

Black Basta is a ransomware operator and Ransomware-as-a-Service (RaaS) criminal enterprise that emerged in early 2022. It quickly became one of the most active RaaS threat actors globally, targeting organizations in the US, Japan, Canada, the United Kingdom, Australia, and New Zealand with highly targeted attacks.

Black Basta employs a double extortion tactic - encrypting critical data and vital servers, before threatening to publish sensitive information on their public leak site. The group’s core membership may have originated from the defunct Conti threat actor group, evidenced by similarities in malware development, leak sites, and communication strategies.

Their attack arsenal includes tools like QakBot and exploits such as PrintNightmare. In early campaigns, they used spear-phishing for initial access and advertised buying corporate network access. Their second-stage tactics involve acquiring Windows Domain credentials, lateral movement within networks, data theft, and ransomware deployment. They use Cobalt Strike and SystemBC for command and control, followed by Rclone for data exfiltration.

The encryption stage involves disabling antivirus products, executing an encryption payload via PowerShell, and deleting system shadow copies.

Cyber Threat Graph Context

Explore how this Intrusion Set relates to the wider threat graph

Black Basta Ransomware Group Threat Reports

Report

Threat Assessment: Black Basta Ransomware

This threat assessment from Palo Alto's Unit 42 describes the Black Basta 'Ransomware as a Service' operation including TTPs (tactics, techniques ...

View Source

Report

Ransomware Spotlight: Black Basta

This report from Trend Micro outlines tactics, techniques and procedures used by the Black Basta Ransomware group. According to the report, Black ...

View Source

Report

Threat Actor Groups, Including Black Basta, are Exploiting Recent ScreenConnect Vulnerabilities

This blog post gives a detailed analysis of two critical vulnerabilities (CVE-2024-1708 and CVE-2024-1709) affecting ConnectWise ScreenConnect ...

View Source

References

MITRE ATT&CK Techniques

MITRE ATT&CK techniques observed in use by this intrusion set.

Search:

ATT&CK ID	Title	Associated Tactics
T1489	Service Stop	Impact
T1082	System Information Discovery	Discovery
T1112	Modify Registry	Defense Evasion
T1569.002	Service Execution	Execution
T1218.010	Regsvr32	Defense Evasion
T1573	Encrypted Channel	Command and Control
T1486	Data Encrypted for Impact	Impact
T1562.001	Disable or Modify Tools	Defense Evasion
T1136	Create Account	Persistence
T1566.001	Spearphishing Attachment	Initial Access
T1543.003	Windows Service	Persistence, Privilege Escalation
T1047	Windows Management Instrumentation	Execution
T1219	Remote Access Software	Command and Control
T1622	Debugger Evasion	Defense Evasion, Discovery
T1140	Deobfuscate/Decode Files or Information	Defense Evasion
T1555	Credentials from Password Stores	Credential Access
T1560.001	Archive via Utility	Collection
T1562.009	Safe Mode Boot	Defense Evasion
T1484.001	Group Policy Modification	Defense Evasion, Privilege Escalation
T1059.001	PowerShell	Execution
T1574.001	DLL Search Order Hijacking	Defense Evasion, Persistence, Privilege Escalation
T1567	Exfiltration Over Web Service	Exfiltration
T1490	Inhibit System Recovery	Impact
T1021.001	Remote Desktop Protocol	Lateral Movement
T1016	System Network Configuration Discovery	Discovery
T1087.002	Domain Account	Discovery
T1562.004	Disable or Modify System Firewall	Defense Evasion
T1098	Account Manipulation	Persistence, Privilege Escalation
T1070.004	File Deletion	Defense Evasion
T1041	Exfiltration Over C2 Channel	Exfiltration
T1018	Remote System Discovery	Discovery
T1083	File and Directory Discovery	Discovery
T1491	Defacement	Impact
T1570	Lateral Tool Transfer	Lateral Movement
T1059.003	Windows Command Shell	Execution
T1003	OS Credential Dumping	Credential Access
T1068	Exploitation for Privilege Escalation	Privilege Escalation
T1078	Valid Accounts	Defense Evasion, Initial Access, Persistence, Privilege Escalation
T1620	Reflective Code Loading	Defense Evasion
T1105	Ingress Tool Transfer	Command and Control
T1482	Domain Trust Discovery	Discovery
T1562	Impair Defenses	Defense Evasion
T1087	Account Discovery	Discovery
T1190	Exploit Public-Facing Application	Initial Access

Showing 1 to 44 of 44 entries

Black Basta Ransomware Group

Cyber Threat Graph Context

Black Basta Ransomware Group Threat Reports

Threat Assessment: Black Basta Ransomware

Ransomware Spotlight: Black Basta

Threat Actor Groups, Including Black Basta, are Exploiting Recent ScreenConnect Vulnerabilities

References

www.trendmicro.com

cyware.com

unit42.paloaltonetworks.com

www.blackberry.com

www.trendmicro.com

medium.com

www.trendmicro.com

MITRE ATT&CK Techniques