blackbasta Ransomware
Tracked since Apr 26, 2022
0
victims recorded
0
in the last 30 days
0
CVEs
—
Last activity
In MITRE ATT&CK MITRE ATT&CK
Ransomware cataloged as Black Basta (S1070)
Used by: Storm-1811 G1046
"Black Basta" is a new ransomware strain discovered during April 2022 - looks in dev since at least early February 2022 - and due to their ability to quickly amass new victims and the style of their negotiations, this is likely not a new operation but rather a rebrand of a previous top-tier ransomware gang that brought along their affiliates.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Tactics and techniques (MITRE ATT&CK)
Initial Access
T1566.001 Phishing: Spear phishing Attachment Execution
T1047 Windows Management InstrumentationT1059.001 Command and Scripting Interpreter: PowerShellT1569.002 System Services: Service Execution Persistence
T1098 Account ManipulationT1136 Create AccountT1543.003 Create or Modify System Process: Windows ServiceT1574.001 Hijack Execution Flow: DLL Search Order Hijacking Privilege Escalation
T1484.001 Domain Policy Modification: Group Policy ModificationT1543.003 Create or Modify System Process: Windows ServiceT1574.001 Hijack Execution Flow: DLL Search Order Hijacking Observed tools
Credential Theft
Mimikatz
Defense Evasion
Backstab (Process Explorer driver)
Discovery Enum
AdFind · Bloodhound · PSNmap · PowerView · SoftPerfect NetScan
Exfiltration
Qaz[.]im · RClone
LOLBAS
BITSAdmin · PsExec · Quick Assist
Offsec
Brute Ratel C4 · Cobalt Strike · Metasploit · PowerSploit
RMM-Tools
AnyDesk · Atera · NetSupport · ScreenConnect · Splashtop · Supremo
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live