blackbasta Ransomware
Monitorado desde 26/04/2022
0
vítimas registradas
0
nos últimos 30 dias
0
CVEs
—
Última atividade
No MITRE ATT&CK MITRE ATT&CK
Ransomware catalogado como Black Basta (S1070)
Usado por: Storm-1811 G1046
"Black Basta" is a new ransomware strain discovered during April 2022 - looks in dev since at least early February 2022 - and due to their ability to quickly amass new victims and the style of their negotiations, this is likely not a new operation but rather a rebrand of a previous top-tier ransomware gang that brought along their affiliates.
Vulnerabilidades citadas para este grupo
CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.
Nenhuma CVE associada a este grupo nas fontes.
Táticas e técnicas (MITRE ATT&CK)
Initial Access
T1566.001 Phishing: Spear phishing Attachment Execution
T1047 Windows Management InstrumentationT1059.001 Command and Scripting Interpreter: PowerShellT1569.002 System Services: Service Execution Persistence
T1098 Account ManipulationT1136 Create AccountT1543.003 Create or Modify System Process: Windows ServiceT1574.001 Hijack Execution Flow: DLL Search Order Hijacking Privilege Escalation
T1484.001 Domain Policy Modification: Group Policy ModificationT1543.003 Create or Modify System Process: Windows ServiceT1574.001 Hijack Execution Flow: DLL Search Order Hijacking Ferramentas observadas
Credential Theft
Mimikatz
Defense Evasion
Backstab (Process Explorer driver)
Discovery Enum
AdFind · Bloodhound · PSNmap · PowerView · SoftPerfect NetScan
Exfiltration
Qaz[.]im · RClone
LOLBAS
BITSAdmin · PsExec · Quick Assist
Offsec
Brute Ratel C4 · Cobalt Strike · Metasploit · PowerSploit
RMM-Tools
AnyDesk · Atera · NetSupport · ScreenConnect · Splashtop · Supremo
Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas. · Ver no ransomware.live