Once inside the network, Black Basta targets the Domain Controller, and moves laterally using PsExec. QBot’s capabilities can be used to perform reconnaissance, collect data and credentials, move laterally, and download and execute payloads. The alliance with QBot saves the group time and effort in its attacks. It’s too early to know how successful it is at gaining ransom payments, but the group has been seen demanding millions of dollars as the ransom fee. Like most groups operating targeted attacks, Black Basta employs the double extortion strategy. Nevertheless, “Black Basta is likely operated by former members of the defunct Conti and REvil gangs, the two most profitable ransomware gangs in 2021,” comments Lior Div, Cybereason CEO and co-founder. Conti has denied this, saying, “BlackBasta is not conti it’s… kids.” There are several similarities between the two operations, including the appearance of the leak Tor site, the ransom note, the payment site and behavior of the support team. Its rapid rise has led to some speculation that this is not their first time on the dance floor – with some suggestions that the gang might be related to Conti.

The suggestion is that Black Basta is copying the techniques of the major ransomware gangs. “Some of them used to perform reconnaissance, collect data and credentials, move laterally, and download and execute payloads.” “QBot has many built-in capabilities that are very useful for attackers,” say Cybereason researchers in a report. Researchers at Cybereason have reported that it became known in early June that the new Black Basta group has partnered with the QBot malware operation to spread their ransomware.Ī QBot partnership is a well-worn path, with criminal groups including MegaCortex, ProLock, DoppelPaymer, Conti and Egregor all having done the same. On April 20, 2022, a user named BlackBasta announced on underground forums an intention to purchase corporate network accesses for a share of the profits. Since then, the Black Basta group has claimed responsibility for 36 victims in English-speaking countries, and the number is growing. Evidence suggests it was still in development in February 2022, and only became operational in April 2022.

Security researchers have assessed the Black Basta ransomware threat level as HIGH, and the number of victims is still risingīlack Basta ransomware has become a major new threat in just a couple months.

Crowdstrike download mac